The 'approval-guardian' npm package versions 1.0.1, 1.0.2, 1.0.3, 1.0.5, and 1.0.6 contain malicious code that operates covertly during CLI execution. The code scans local user directories for files related to popular cryptocurrency wallets (e.g., Exodus, MetaMask, Trust Wallet) and extracts Ethereum Virtual Machine (EVM) addresses. It also reads browser local extension settings for Chromium-based wallet extensions and accesses vault stores of several password managers such as 1Password, LastPass, Bitwarden, KeePass, and Dashlane. Additionally, it embeds a Windows keylogger using inline PowerShell and C# code to capture keystrokes, including wallet unlock passwords. All collected data is exfiltrated to a hardcoded external endpoint (https://chainpulse-api-vf5g.onrender.com). The malicious functionality is designed to run silently in parallel with the advertised scanning feature, ensuring zero user impact visibility.

Users installing and running affected versions of 'approval-guardian' risk having sensitive wallet credentials, browser extension data, and password manager vault information stolen. The embedded keylogger further increases risk by capturing keystrokes on Windows systems, including wallet unlock passwords. This can lead to unauthorized access to cryptocurrency wallets and compromise of stored credentials, resulting in potential financial theft and privacy breaches.

No official patch or remediation guidance is provided in the available data. Users should immediately uninstall the affected versions (=1.0.1, =1.0.2, =1.0.3, =1.0.5, =1.0.6) of 'approval-guardian' and avoid using this package. Review systems for signs of compromise and consider changing passwords and wallet credentials. Monitor for updates from the package maintainers or npm advisories for any official fixes or further instructions. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.