No confirmed malicious attack surface was established. The package is a crypto/agent CLI with high-risk user-invoked capabilities, but inspected behavior is aligned with its declared wallet, payment, MCP, and skill-install features.
Explicit user commands such as `mp wallet`, `mp token bridge`, `mp mcp`, or `mp skill install`.
Impact
Can move funds or expose agent tools when the user invokes those commands, but no install-time or import-time theft/persistence was found.
Mechanism
User-invoked local wallet signing, MoonPay API calls, and optional agent skill copy.
Rationale
Static inspection found dangerous crypto and agent-facing capabilities, but they are declared, package-aligned, and activated by explicit CLI/MCP commands with no npm lifecycle hook or import-time execution. The scanner’s exfiltration/wallet-drain labels map to local wallet signing and MoonPay transaction workflows rather than a hidden attack path.
AI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for block
User-invoked wallet tools can sign and broadcast swaps, bridges, card delegation, prediction-market, commerce, and offramp transactions in dist/chunk-57BKXEO2.js.
`mp skill install` copies bundled MoonPay skills to `~/.claude/skills` or a chosen directory, but only via explicit CLI command.
Uses child_process for OS keychain access and opening dflow verification URLs, not install-time execution.
Evidence against
package.json has no npm lifecycle hooks; only bin entries `moonpay` and `mp` point to dist/index.js.
Wallet secrets are stored locally via @open-wallet-standard and encrypted/keychain-backed config under `~/.config/moonpay`; inspected flows sign locally rather than directly exfiltrating keys.
Network calls are package-aligned MoonPay API/tool calls or chain data/RPC helpers, not arbitrary credential upload endpoints.
MCP server is started only by `mp mcp`; no automatic agent registration or lifecycle mutation was found.
AI skills are bundled documentation/instructions and installed only on `mp skill install`, matching README usage.
1process.noDeprecation = true; import { createRequire as __createRequire } from "module"; const require = __createRequire(import.meta.url);
L2: import{b as m,d as b}from"./chunk-LMDE72OE.js";var G={};b(G,{decrypt:()=>k,encrypt:()=>T,encryptedFileSchema:()=>O});import{randomBytes as A,scryptSync as v,createCipheriv as X,cre...
L3: `)),t}var a,y,E,J=m(()=>{"use strict";V();a="moonpay-cli",y="encryption-key",E=hn(Sn(),".config","moonpay",".encryption-key")});export{G as a,P as b,Nn as c,J as d,Q as e,U as f,j ...
High
Child Process
Package source references child process execution.
1process.noDeprecation = true; import { createRequire as __createRequire } from "module"; const require = __createRequire(import.meta.url);
L2: import{b as m,d as b}from"./chunk-LMDE72OE.js";var G={};b(G,{decrypt:()=>k,encrypt:()=>T,encryptedFileSchema:()=>O});import{randomBytes as A,scryptSync as v,createCipheriv as X,cre...
L3: `)),t}var a,y,E,J=m(()=>{"use strict";V();a="moonpay-cli",y="encryption-key",E=hn(Sn(),".config","moonpay",".encryption-key")});export{G as a,P as b,Nn as c,J as d,Q as e,U as f,j ...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
process.noDeprecation = true; import { createRequire as __createRequire } from "module"; const require = __createRequire(import.meta.url);
L2: import{b as m,d as b}from"./chunk-LMDE72OE.js";var G={};b(G,{decrypt:()=>k,encrypt:()=>T,encryptedFileSchema:()=>O});import{randomBytes as A,scryptSync as v,createCipheriv as X,cre...
L3: `)),t}var a,y,E,J=m(()=>{"use strict";V();a="moonpay-cli",y="encryption-key",E=hn(Sn(),".config","moonpay",".encryption-key")});export{G as a,P as b,Nn as c,J as d,Q as e,U as f,j ...
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
1process.noDeprecation = true; import { createRequire as __createRequire } from "module"; const require = __createRequire(import.meta.url);
L2: import{a as Xe,b as l,c as nt}from"./chunk-OJXD3BKB.js";import{a as ot,b as q,c as ze,d as xe,e as at,i as st,j as Ie,k as Te,l as Ce,n as _,o as ct,p as pt,q as qe,r as dt,s as lt...
L3: Privacy Policy: ${mr}
L4: Swaps by: ${yr}`;import*as vt from"fs";import*as St from"os";import*as Pt from"path";var c=e=>e;function B(e){switch(e.type){case"solana":return e.base64;case"tron":return...
L5: By using this CLI, you agree to:
...
L7:
L8: `),gt({agentId:t,tosVersion:"1.4",cliVersion:et}),{tosVersion:r.tosVersion,acceptedAt:r.acceptedAt}});var fr=Pt.join(St.homedir(),".config","moonpay","consent.json"),jt=p(yt,async(...
L9: `||a==="\r"?(p
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
1process.noDeprecation = true; import { createRequire as __createRequire } from "module"; const require = __createRequire(import.meta.url);
L2: import{a as Xe,b as l,c as nt}from"./chunk-OJXD3BKB.js";import{a as ot,b as q,c as ze,d as xe,e as at,i as st,j as Ie,k as Te,l as Ce,n as _,o as ct,p as pt,q as qe,r as dt,s as lt...
L3: Privacy Policy: ${mr}
L4: Swaps by: ${yr}`;import*as vt from"fs";import*as St from"os";import*as Pt from"path";var c=e=>e;function B(e){switch(e.type){case"solana":return e.base64;case"tron":return...
L5: By using this CLI, you agree to:
...
L7:
L8: `),gt({agentId:t,tosVersion:"1.4",cliVersion:et}),{tosVersion:r.tosVersion,acceptedAt:r.acceptedAt}});var fr=Pt.join(St.homedir(),".config","moonpay","consent.json"),jt=p(yt,async(...
L9: `||a==="\r"?(p
Critical
Wallet Drain
Source uses private key material to transfer cryptocurrency funds.
1Trigger-reachable chain: manifest.bin -> dist/index.js -> dist/chunk-57BKXEO2.js
L1: process.noDeprecation = true; import { createRequire as __createRequire } from "module"; const require = __createRequire(import.meta.url);
L2: import{a as Xe,b as l,c as nt}from"./chunk-OJXD3BKB.js";import{a as ot,b as q,c as ze,d as xe,e as at,i as st,j as Ie,k as Te,l as Ce,n as _,o as ct,p as pt,q as qe,r as dt,s as lt...
L3: Privacy Policy: ${mr}
L4: Swaps by: ${yr}`;import*as vt from"fs";import*as St from"os";import*as Pt from"path";var c=e=>e;function B(e){switch(e.type){case"solana":return e.base64;case"tron":return...
L5: By using this CLI, you agree to:
...
L7:
L8: `),gt({agentId:t,tosVersion:"1.4",cliVersion:et}),{tosVersion:r.tosVersion,acceptedAt:r.acceptedAt}});var fr=Pt.join(St.h
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
1process.noDeprecation =true; import { createRequire as __createRequire } from"module"; constrequire=__createRequire(import.meta.url);
2import{b as m,d as b}from"./chunk-LMDE72OE.js";varG={};b(G,{decrypt:()=>k,encrypt:()=>T,encryptedFileSchema:()=>O});import{randomBytes as A,scryptSync
3`)),t}var a,y,E,J=m(()=>{"use strict";V();a="moonpay-cli",y="encryption-key",E=hn(Sn(),".config","moonpay",".encryption-key")});export{G as a,P as b,Nn as c,J as d,Q as e,U as f,j as g,d as h,Pn as i,S as j,cn as k,Un as l,jn as m,un as n,Jn as o,V as p};
High
Child Process
Package source references child process execution.
1process.noDeprecation =true; import { createRequire as __createRequire } from"module"; constrequire=__createRequire(import.meta.url);
2import{a
as
v,createCipheriv
as
X,createDecipheriv
as
$}
from
"crypto"
;
import
{z
as
i}
from
"zod"
;
function
T
(
n
,
t
){
let
r
=
A
(
32
),o
=
v
(t,r,
D
,{N:
R
,r:
L
,p:
F
,maxmem:
K
}),s
=
A
(
12
),c
=
X
(
"aes-256-gcm"
,o,s),_
=
Buffer.
concat
([c.
update
(n,
"utf8"
),c.
final
()]);
return
{encryption:{cipher:
"aes-256-gcm"
,kdf:
"scrypt"
,kdfparams:{n:
R
,r:
L
,p:
F
},salt:r.
toString
(
"base64"
),iv:s.
toString
(
"base64"
),tag:c.
getAuthTag
().
toString
(
"base64"
)},data:_.
toString
(
"base64"
)}}
function
k
(
n
,
t
){
let
{
salt
:r,
iv
: ...
as
Xe,b
as
l,c
as
nt}
from
"./chunk-OJXD3BKB.js"
;
import
{a
as
ot,b
as
q,c
as
ze,d
as
xe,e
as
at,i
as
st,j
as
Ie,k
as
Te,l
as
Ce,n
as
_,o
as
ct,p
as
pt,q
as
qe,r
as
dt,s
as
lt,t
as
$e,u
as
$,v
as
ut,w
as
fe}
from
"./chunk-53TCG4EG.js"
;
import
{e
as
et,f
as
He,g
as
tt,h
as
Se,i
as
Pe,k
as
it,l
as
rt,m
as
he,o
as
je,p
as
V}
from
"./chunk-FYUCXMP3.js"
;
var
Rn
=
[{name:
"app_activation_create"
,description:
"Record a MoonAgents desktop app activation event (install or update)."
,inputSchema:{$ref:
"#/definitions/app_activation_create_input"
,definitions:{app_activation_create_input:{type:
"object"
,properties
...
3 Privacy Policy: ${mr}
4 Swaps by: ${yr}`;import*as vt from"fs";import*as St from"os";import*as Pt from"path";var c=e=>e;function B(e){switch(e.type){case"solana":return e.base64;case"tron":return JSON.stringify(e);case"ton":return e.boc;case"filecoin":return JSON.stringify(e);case"evm":return JSON.stringify(e);default:return JSON.stringify(e)}}var p=(e,t)=>({schema:e,handler:async i=>{let r=e.input.parse(i),n=await t(r);return e.output.parse(n)}});import{z as ge}from"zod";var yt=c({name:"consent_check",description:"Check whether the MoonPay Terms of Use have been accepted. Throws if not accepted",input:ge. ...
5By using this CLI, you agree to:
6${mt}
7
8`),gt({agentId:t,tosVersion:"1.4",cliVersion:et}),{tosVersion:r.tosVersion,acceptedAt:r.acceptedAt}});var fr=Pt.join(St.homedir(),".config","moonpay","consent.json"),jt=p(yt,async()=>{let e=null;try{e=JSON.parse(vt.readFileSync(fr,"utf-8"))}catch{}if(!e||e.tosVersion!=="1.4"){let t=await Re.handler({});return{accepted:!0,tosVersion:t.tosVersion,acceptedAt:t.acceptedAt}}return{accepted:!0,tosVersion:e.tosVersion,acceptedAt:e.acceptedAt}});import{z asK}from"zod";var xt=c({name:"wallet_create",description:"Create a new multi-chain HD wallet. Generates a BIP39 mnemonic and derives addresses for S ...
10`),r.close(),t(n.trim())):a===""?(process.stdin.setRawMode(!1),r.close(),process.exit(0)):a==="\x7F"||a==="\b"?n=n.slice(0,-1):n+=a};process.stdin.on("data",o)})}function _r(e){let t=e.split(/\s+/);return t.length>=12&&t.length<=24&&Ct(e,qt)?"mnemonic":"key"}var $t=p(Tt,async e=>{if(e.mnemonic&&e.key)throw new Error("Provide either --mnemonic or --key, not both.");let t=e.mnemonic,i=e.key;if(!t&&!i){let s=await br("Paste your mnemonic or private key (hidden): ");if(!s)throw new Error("No input provided.");_r(s)==="mnemonic"?t=s:i=s}if(t){let s=t.trim().toLowerCase();if(!Ct(s,qt))throw new Err ...
11Run this command directly in your terminal: mp wallet export `+e.wallet);let t=_(e.wallet);if(t.type==="hardware")throw newError(`Wallet "${t.name}" is a hardware wallet (${t.device}). There are no secrets to export \u2014 keys live on the device.`);let i=qe(t.name),r=i.includes(" ");if(e.chain){if(!r)return process.stderr.write(`
12Wallet "${t.name}" is an imported single-key wallet.
13The --chain flag is only meaningful for HD wallets. Exporting the key as-is.
14
15`),process.stderr.write(`Private key for "${t.name}":