The crypto-hasher npm package versions 3.1.2 and 3.1.3 impersonate the legitimate hash-wasm library but inject malicious code into the WASM Interface update() method. When hashing data containing the trigger string 'alicebob100', it spawns a detached Node.js child process that connects to Ethereum Sepolia RPC endpoints via base64-obfuscated URLs to retrieve encrypted material and passwords from a smart contract. It performs cryptographic operations (X25519 ECDH, PBKDF2, AES-GCM) to recover a wallet private key. The malware exfiltrates host reconnaissance data (platform, release, architecture, hostname, CPUs, memory, uptime) to Slack and Telegram using hardcoded bearer tokens and chat IDs. A second component polls Slack for encrypted commands, decrypts them, writes executable files to disk, and runs them under Node.js, establishing a persistent remote code execution backdoor. An 'exitexitexit' command deletes malicious files and modifies the LICENSE file to hinder forensic analysis. The malware uses string-array rotation and base64 wrapping for obfuscation. This results in full compromise of any system running these package versions.

Systems with crypto-hasher versions 3.1.2 or 3.1.3 installed or running are fully compromised. The attacker can recover wallet private keys, exfiltrate sensitive host information, and maintain persistent remote code execution access. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

No official patch or fix is currently available for this malicious package. Immediate removal of crypto-hasher versions 3.1.2 and 3.1.3 is strongly recommended. All secrets and cryptographic keys stored on affected systems should be rotated from a separate, trusted environment. Due to the persistent backdoor and anti-forensic measures, assume full system compromise and consider rebuilding the affected hosts. Monitor for any suspicious network connections to Ethereum RPC endpoints, Slack, or Telegram APIs. Patch status is not yet confirmed — check vendor advisories or trusted sources for updates.