취약점

Crypto/SSH/wallet stealer, blockchain-helper-0 campaign sibling (c960+), same aicrypto-xzggg publisher and "Core utilities for blockchain development" description as swap-sdk-87/defi-tools-39. postinstall auto-execs, src/index.js harvests ~/.ssh keys + Sol/Eth/BTC/Tron/Sui/Aptos wallets + .env + seeds, self-labels "CRYPTO STEALER", exfils to SAME Telegram bot 8227918239 chat 6433587894 (not rotated). Inflated version (4.68.54).

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1a40867051c796d19f9e375a3f07f7cb616aaaa75fb51d557ea7c1ae0fbbd790)

On install (postinstall hook requires src/index.js), the package enumerates installer-side secrets — ~/.ssh/id_rsa and id_ed25519, ~/.config/solana/id.json, Ethereum keystore files, Bitcoin wallet.dat, Tron/Sui/Aptos wallet files,.env, mnemonic.txt, seed.txt — and uploads each found file to api.telegram.org/bot/sendDocument using a hardcoded bot token (8227918239:AAGE...) and chat_id (6433587894). Hostname and username are also sent in a message labeled 'CRYPTO STEALER' for victim attribution. Execution is gated by anti-analysis checks (CI=true, GITHUB_ACTIONS, JENKINS_HOME, NODE_ENV=test, usernames matching runner/sandbox/docker, 12-hex docker container hostnames) and delayed by setTimeout(7434) so it fires only on real developer machines. The author's own message label confirms malicious intent.