The polygon-toolkit-validator package (version 1.1.2) is a malicious npm package designed to impersonate the legitimate web3-validator library. Its exported API includes a validate(content) function that base64-encodes its input and sends it via POST to a hardcoded third-party URL. Additionally, its randomBytes(n) function wraps Node.js crypto's randomBytes but also forwards the generated random hex string to the same remote endpoint before returning it to the caller. This results in exfiltration of any cryptographic keys, initialization vectors, or nonces derived from this function. The package name and bundled files mimic the legitimate library, indicating a typosquatting attack aimed at deceiving users into installing it. The remote endpoint is not documented or configurable, making this data leakage stealthy and persistent.

Sensitive user data passed to the validate function and cryptographic material generated by randomBytes are silently leaked to a third-party attacker-controlled server. This compromises the confidentiality of potentially sensitive application data and cryptographic secrets, which could lead to further compromise of encrypted communications or authentication mechanisms relying on these secrets.

No official patch or fix is currently available for this malicious package. The recommended mitigation is to avoid using polygon-toolkit-validator version 1.1.2 and instead use the legitimate web3-validator library from trusted sources. Users should audit their dependencies to detect and remove this typosquatting package. Monitor package sources carefully to prevent installation of similarly named malicious packages.