[email protected] is a malicious npm package embedding approximately 2800 lines of infostealer code directly in its index.js file. It executes this payload at install time via a postinstall script that runs node test.js. The payload targets a wide range of sensitive information including cryptocurrency wallets (MetaMask, Phantom, Solflare, OKX, Coinbase, TrustWallet, Backpack, TronLink), browser cookies, credentials, SSH keys, AWS credentials, .npmrc tokens, Docker configuration files, shell history, and password manager databases. The harvested data is exfiltrated to the C2 domain log-taker.store, which is linked to the maintainer account rohmat2527. The package uses child_process execSync calls to run bash and zsh commands to collect shell history, confirming its intent to steal credentials. The malicious nature was confirmed by malware detection filters.

Successful installation of [email protected] results in theft of extensive sensitive data including cryptocurrency wallets, authentication credentials, cloud service keys, and local environment secrets. This can lead to unauthorized access to user accounts, financial theft, and compromise of development and deployment environments. The exfiltration to a remote C2 domain enables attackers to collect stolen data remotely, facilitating further exploitation.

No official patch or remediation is available for [email protected]. Users and organizations should avoid installing or using this package. Remove any installations of [email protected] immediately. Review systems for signs of compromise, especially focusing on exposed credentials and secrets. Rotate any potentially exposed credentials, keys, and tokens. Monitor for suspicious network connections to the domain log-taker.store. Use trusted package sources and verify package integrity before installation.