The eth-wallet-helpers npm package version 1.0.0 includes a delayed self-executing function that reads a base64-encoded payload from a fixture file, writes it to a hidden cache location, and executes it detached under Node.js. The payload recursively searches the user's home directory for files containing wallet, seed, mnemonic, private key, keystore, or API key data across multiple file extensions. It encrypts the collected data with an embedded RSA public key and uploads it to Pinata IPFS using hardcoded API credentials. Persistence mechanisms are installed per platform: a crontab entry on Linux, a scheduled task named 'WinNodeSync' on Windows, and a LaunchAgent plist on macOS, each running the dropped payload every 12 hours. The use of a 37-second delay and a fixture file name aims to evade sandbox and scanner detection. This malicious activity is not part of the package's stated purpose.

Sensitive wallet-related credentials and keys stored on the user's system can be harvested and exfiltrated to an attacker-controlled IPFS service, potentially leading to compromise of cryptocurrency wallets or other sensitive accounts. The malware establishes persistent execution on the infected system, allowing repeated data theft over time. This compromises user confidentiality and security of wallet assets.

No official patch or remediation is currently available for this malicious package version. Users should immediately uninstall eth-wallet-helpers version 1.0.0 and avoid using this package. Inspect systems for the presence of the dropped payload (~/.cache-db/.node-sync/syncd.js) and remove any persistence mechanisms such as the 12-hour crontab entry on Linux, the 'WinNodeSync' scheduled task on Windows, and the com.apple.syncd LaunchAgent on macOS. Monitor for suspicious IPFS network activity related to Pinata or other gateways. Consider restoring affected systems from known clean backups if compromise is suspected.