The 'abi-encode' npm package (versions 1.0.0, 1.0.1, 1.0.2) contains embedded malicious code that activates 37 seconds after the package is required. It decodes a base64-encoded payload disguised as cryptographic test data and writes it to a hidden path in the user's home directory with restricted permissions. This payload is executed detached from the main process and establishes persistence by adding a crontab entry on Linux or a scheduled task named 'WinNodeSync' on Windows. The payload scans the user's home directory for files related to wallets, seeds, credentials, and private keys, encrypts these files using RSA, and exfiltrates them to attacker-controlled IPFS gateways via the Pinata API using hardcoded credentials and fallback IPFS content identifiers. The combination of delayed execution, disguised payload, hidden file paths, and cross-platform persistence mechanisms confirms the package's malicious intent unrelated to its advertised ABI encoding functionality.

Users who install and require the affected versions of the 'abi-encode' package risk having sensitive wallet and credential files from their home directories exfiltrated to attacker-controlled IPFS nodes. This can lead to theft of private keys, seed phrases, and other confidential information related to cryptocurrency wallets and credentials, potentially resulting in financial loss and compromise of user accounts. The malware establishes persistence on both Linux and Windows systems, increasing the likelihood of prolonged unauthorized access and data theft.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove all affected versions (=1.0.0, =1.0.1, =1.0.2) of 'abi-encode' from their environments. It is recommended to audit systems for the presence of the dropped payload at '~/.cache-db/.node-sync/syncd.js' and remove any related crontab entries or scheduled tasks named 'WinNodeSync'. Users should also review and secure any potentially compromised wallet or credential files and consider them compromised. Monitor vendor advisories or trusted security sources for updates or official remediation guidance.