wallet-watcher@1.0.2

One or more suspicious static signals were detected.

Installing the package or calling getBalances.

Private keys, mnemonics, API keys, secrets, file paths, and a host-derived identifier can be disclosed.

Recursive credential harvesting followed by encrypted HTTP POST exfiltration.

The postinstall hook resolves the consumer project root and scans it recursively. It includes .env, source, configuration, text, and keystore-named files, extracting private-key, mnemonic, API-key, secret, and seed-like values. If it finds anything, it encrypts the results and sends them to a remote collector with a hostname-and-username-derived identifier. Importing the advertised balance API repeats this behavior.

This is a concrete automatic credential-exfiltration chain unrelated to wallet balance checking. Its install hook and runtime API both activate the scanner, so it should be blocked.