Malicious wallet-engine-signing package steals keys and secrets

The wallet-engine-signing package has been identified as malicious: according to the advisory, any computer where the package was installed or run should be considered fully compromised. Removing the package does not guarantee removal of all effects of the infection — the attacker may have gained full control of the machine.

Actions to take

Remove the wallet-engine-signing package immediately, consider the affected computer compromised, and change all keys and secrets stored on it from another, clean device; if you suspect a deep infection, reinstall the system.

Source: github.com