registry / Credential exfiltration / @aladas-org/cryptocalc

@aladas-org/cryptocalc

Cryptocurrency wallet generator

This report shows the evidence for @aladas-org/cryptocalc@0.5.29. 1 of 7 known versions is blocked or flagged. The newest version, 0.5.34, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package intentionally routes wallet recovery phrases to an external endpoint through a benign-looking UI control. This is concrete secret exfiltration despite the absence of install-time hooks.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Generate or load a mnemonic, then click the 3D link.

Impact

Disclosure of a wallet recovery phrase can permit theft of wallet funds.

Mechanism

Mnemonic exfiltration through an external URL query string.

Attack narrative

The active renderer derives a URL from the mnemonic and places it on a visible 3D link. The link opens an external GitHub Pages host in a new tab; the recovery phrase is included in the query string without a warning or consent step. This exposes the phrase to the remote host and normal URL handling/logging.

AI rationale

The package intentionally routes wallet recovery phrases to an external endpoint through a benign-looking UI control. This is concrete secret exfiltration despite the absence of install-time hooks.

Evidence

package.jsonwww/js/view/main_gui.jswww/index.htmlwww/js/_main/electron_main.js

Network endpoints1

aladas-org.github.io/aladas.github.io/

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

Generated mnemonics are appended to an external URL query parameter.
The target is a visible but unexplained external “3D” link opened in a new tab.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
Clipboard writes are limited to explicit copy-button actions.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 188 file(s), 4.71 MB of source, external domains: aladas-org.github.io, aladas.org, atomscan.com, blockchain.com, blockchair.com, bscscan.com, coinfaucet.eu, coinmarketcap.com, docs.cardano.org, dogechain.info, etherscan.io, explore.vechain.org, explorer.dash.org, explorer.firo.org, explorer.horizen.io, explorer.rvn.zelcore.io, explorer.solana.com, guarda.com, iancoleman.io, iplayif.com, litecointf.salmen.website, live.blockcypher.com, livenet.xrpl.org, mainnet.suivision.xyz, mumbaifaucet.com, playwright.bloburl, polygonscan.com, preprod.cardanoscan.io, react.dev, rpc2.sepolia.org, sepolia.etherscan.io, snowtrace.io, sochain.com, solfaucet.com, stellar.expert, testnet-faucet.com, tonscan.org, trace.playwright.dev, tronscan.org, whatsonchain.com, www.blockchain.com, www.blockexplorer.com, www.oklink.com, www.w3.org

Source & flagged code

14 flagged

www/js/crypto/password_strength_evaluator.jsView file

449patternName = generic_password severity = medium line = 449 matchedText = let pass...le';

Medium

Secret Pattern

Package contains a possible secret pattern.

www/js/crypto/password_strength_evaluator.jsView on unpkg · L449

452patternName = generic_password severity = medium line = 452 matchedText = password...er';

Medium

Secret Pattern

Hardcoded password in www/js/crypto/password_strength_evaluator.js

www/js/crypto/password_strength_evaluator.jsView on unpkg · L452

455patternName = generic_password severity = medium line = 455 matchedText = password...st';

Medium

Secret Pattern

Hardcoded password in www/js/crypto/password_strength_evaluator.js

www/js/crypto/password_strength_evaluator.jsView on unpkg · L455

_archives/tests-prev/playwright/playwright-report/trace/assets/defaultSettingsView-CJSZINFr.jsView file

112`)}function TE(n){const e=[{regex:/\b[\d,.]+[bkmBKM]+\b/,replacement:"[\\d,.]+[bkmBKM]+"},{regex:/\b\d+[hmsp]+\b/,replacement:"\\d+[hmsp]+"},{regex:/\b[\d,.]+[hmsp]+\b/,replacement... L113: ${n.stack}`,{e:{n:n.name,m:n.message,s:u}}}if(OA(n))return{d:n.toJSON()};if(jA(n))return{u:n.toJSON()};if(MA(n))return{r:{p:n.source,f:n.flags}};for(const[u,f]of Object.entries(Uv)... L114: (() => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

_archives/tests-prev/playwright/playwright-report/trace/assets/defaultSettingsView-CJSZINFr.jsView on unpkg · L112

_archives/tests-prev/unit/core/constants.test.jsView file

3L4: const { BITCOIN, ETHEREUM } = require('../../../www/js/crypto/const_blockchains.js'); L5: const { PRIVATE_KEY, ADDRESS } = require('../../../www/js/crypto/const_wallet.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

_archives/tests-prev/unit/core/constants.test.jsView on unpkg · L3

www/js/view/_archives/main_gui.jsView file

3// ===================================================================================================================== L4: // https://www.electronjs.org/docs/latest/tutorial/quick-start L5: ... L42: // * updateWIF( blockchain, wif ) L43: // * updatePrivateKey( blockchain, PRIV_KEY ) L44: // * async updateChecksum( entropy ) ... L465: // ---------- Private Key ---------- L466: let private_key = json_data[PRIVATE_KEY]; L467: this.wallet_info.setAttribute( PRIVATE_KEY, private_key ); ... L1394: if ( options_data == undefined ) { L1395: trace2Main(" " + _RED_ + "**ERROR** options_data: " + options_data + _END_); L1396: await window.ipcMain.QuitApp();

Critical

Clipboard Crypto Hijack

Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.

www/js/view/_archives/main_gui.jsView on unpkg · L3

_archives/tests-prev/_open_cmd_window.batView file

•path = _archives/tests-prev/_open_cmd_window.bat kind = build_helper sizeBytes = 13 magicHex = 737461727420636d642e657865

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

_archives/tests-prev/_open_cmd_window.batView on unpkg

_archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zipView file

•path = _archives/tests-prev/playwright/playwright-[redacted].zip kind = high_entropy_blob sizeBytes = 5025 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

_archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zipView on unpkg

•path = _archives/tests-prev/playwright/playwright-[redacted].zip kind = compressed_blob sizeBytes = 5025 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

_archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zipView on unpkg

•path = _archives/tests-prev/playwright/playwright-[redacted].zip kind = nested_archive_needs_inspection sizeBytes = 5025 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

tests/_run_tests.pyView file

•path = tests/_run_tests.py kind = payload_in_excluded_dir sizeBytes = 6295 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/_run_tests.pyView on unpkg

www/js/_main/db/previous/sqlite_utils_Not_Synchronous.jsView file

204patternName = generic_password severity = medium line = 204 matchedText = const ha...Fi';

Medium

Secret Pattern

Hardcoded password in www/js/_main/db/previous/sqlite_utils_Not_Synchronous.js

www/js/_main/db/previous/sqlite_utils_Not_Synchronous.jsView on unpkg · L204

www/js/_main/db/previous/sqlite_utils previous.jsView file

199patternName = generic_password severity = medium line = 199 matchedText = const ha...Fi';

Medium

Secret Pattern

Hardcoded password in www/js/_main/db/previous/sqlite_utils previous.js

www/js/_main/db/previous/sqlite_utils previous.jsView on unpkg · L199

www/js/_main/db/sqlite_utils.jsView file

343patternName = generic_password severity = medium line = 343 matchedText = const ha...Fi';

Medium

Secret Pattern

Hardcoded password in www/js/_main/db/sqlite_utils.js

www/js/_main/db/sqlite_utils.jsView on unpkg · L343

Source & flagged code

14 flagged · loading source

www/js/crypto/password_strength_evaluator.jsView file

449patternName = generic_password severity = medium line = 449 matchedText = let pass...le';

Medium

Secret Pattern

Package contains a possible secret pattern.

www/js/crypto/password_strength_evaluator.jsView on unpkg · L449

452patternName = generic_password severity = medium line = 452 matchedText = password...er';

Medium

Secret Pattern

Hardcoded password in www/js/crypto/password_strength_evaluator.js

www/js/crypto/password_strength_evaluator.jsView on unpkg · L452

455patternName = generic_password severity = medium line = 455 matchedText = password...st';

Medium

Secret Pattern

Hardcoded password in www/js/crypto/password_strength_evaluator.js

www/js/crypto/password_strength_evaluator.jsView on unpkg · L455

Findings

1 Critical2 High13 Medium6 Low

CriticalClipboard Crypto Hijackwww/js/view/_archives/main_gui.js

HighShips High Entropy Blob_archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zip

HighPayload In Excluded Dirtests/_run_tests.py

MediumSecret Patternwww/js/crypto/password_strength_evaluator.js

MediumDynamic Require_archives/tests-prev/unit/core/constants.test.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Build Helper_archives/tests-prev/_open_cmd_window.bat

MediumShips Compressed Blob_archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zip

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to @aladas-org/cryptocalc@0.5.29.

The versions list below shows the verdict for each recorded version.

Avoid installing @aladas-org/cryptocalc@0.5.29. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-22 14:27:23.317Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

7 known versions

0.5.34latestSuspicious—WarnPublishedOct 21, 2026, 9:52 PM 0.5.33Clean—AllowPublishedOct 18, 2026, 1:00 PM 0.5.32SuspiciousRemote Code ExecutionWarnPublishedOct 1, 2026, 9:55 PM 0.5.31Manual Review—AllowUnder ReviewSep 28, 2026, 10:07 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Runtime surface

Behavioral surface

Related packages

Other credential exfiltration packages

Source & flagged code