registry / Credential exfiltration / moltspay
moltspay
Payment infrastructure for AI Agents - Server & Client SDK
This report shows the evidence for moltspay@2.4.2. 1 of 2 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection confirms a concrete wallet-drain primitive: automatic unlimited approvals to a fixed address, paired with transferFrom capability. The install hook is not the attack path, but the user-invoked CLI flow is sufficient to expose funds.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs `moltspay init --chain bnb` or `--chain bnb_testnet`.
Impact
The fixed spender can drain approved token balances independently of per-payment limits.
Mechanism
Automatic MaxUint256 token approvals to a fixed spender
Attack narrative
On explicit BNB wallet initialization, the CLI selects a package-hardcoded spender and automatically submits unlimited USDC and USDT approvals. The BNB facilitator includes transferFrom settlement using the configured server key. Although payment intents are validated in the normal path, an unlimited allowance to a fixed third-party address permits that address to transfer tokens without those client-side spending limits or payment confirmation.
AI rationale
Source inspection confirms a concrete wallet-drain primitive: automatic unlimited approvals to a fixed address, paired with transferFrom capability. The install hook is not the attack path, but the user-invoked CLI flow is sufficient to expose funds.
Evidence
package.jsonscripts/postinstall.jsdist/cli/index.jsdist/index.js~/.moltspay/wallet.json
Network endpoints2
bsc-dataseed.binance.orgdata-seed-prebsc-1-s1.binance.org:8545
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- dist/cli/index.js hardcodes a default BNB spender address.
- `init --chain bnb` automatically calls approval setup for that address.
- Approval setup grants MaxUint256 for USDC and USDT.
- BNB settlement can call transferFrom using the spender key.
Evidence against
- The approval is reached through an explicit CLI init command, not postinstall.
- BNB settlement checks signed payment intent recipient and amount.
- Postinstall only invokes the declared Alipay helper CLI.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
68var import_fs3 = require("fs");
L69: var import_http = require("http");
L70: var path3 = __toESM(require("path"));
...
L87: const envPaths = [
L88: path.join(process.cwd(), ".env"),
L89: path.join(process.env.HOME || "", ".moltspay", ".env")
L90: ];
...
L155: requestPath: urlPath,
L156: requestBody: body
L157: });
...
L212: });
L213: const result = await response.json();
Critical
Wallet Drain
Source uses private key material to transfer cryptocurrency funds.
dist/index.jsFindings
2 Critical6 High5 Medium5 Low
CriticalWallet Draindist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShell
HighFixed Recipient Near Full Balance Transferdist/index.js
HighEntrypoint Foreign Package Code Overwritedist/index.js
HighCommand Output Exfiltrationdist/cli/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/cdp/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to moltspay@2.4.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing moltspay@2.4.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.