Malicious code in arb-kit (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ef3587f45144a9473e246cbffd1c4d03c2f895aa5052801282c4e1dd3e76be30) arb-kit advertises itself as an Arbitrum ABI/gas toolkit, but the main entry (index.js) contains an IIFE that, 37 seconds after require, reads a base64 blob from test/fixtures/keypairs.dat, decodes it, and writes the decoded JavaScript to ~/.cache-db/.node-sync/syncd.js. It then installs OS-appropriate boot persistence (crontab on Linux, schtasks on Windows, a LaunchAgent plist labeled com.apple.syncd on macOS) and spawns node on the dropped script detached. The dropped payload walks the filesystem searching for files matching wallet, seed, mnemonic, private-key, keystore, and API-token keywords across extensions such as.env,.key,.keystore,.pem,.json, and.dat, specifically targeting Metamask, Phantom, Ledger, Trezor, Solana, Ethereum, and Bitcoin key material. Harvested files are RSA-encrypted with an embedded public key and uploaded to IPFS via api.pinata.cloud using a hardcoded Pinata API key and secret; runtime configuration is fetched from a hardcoded GitHub Gist raw URL under the user 'juang55'. The disguised staging path (.cache-db/.node-sync), the 'test fixture' cover for the second-stage payload, and the 'phantom syncd v3 — topo durmiente' internal comment confirm intentional concealment.
Malicious code in arb-kit (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ef3587f45144a9473e246cbffd1c4d03c2f895aa5052801282c4e1dd3e76be30) arb-kit advertises itself as an Arbitrum ABI/gas toolkit, but the main entry (index.js) contains an IIFE that, 37 seconds after require, reads a base64 blob from test/fixtures/keypairs.dat, decodes it, and writes the decoded JavaScript to ~/.cache-db/.node-sync/syncd.js. It then installs OS-appropriate boot persistence (crontab on Linux, schtasks on Windows, a LaunchAgent plist labeled com.apple.syncd on macOS) and spawns node on the dropped script detached. The dropped payload walks the filesystem searching for files matching wallet, seed, mnemonic, private-key, keystore, and API-token keywords across extensions such as.env,.key,.keystore,.pem,.json, and.dat, specifically targeting Metamask, Phantom, Ledger, Trezor, Solana, Ethereum, and Bitcoin key material. Harvested files are RSA-encrypted with an embedded public key and uploaded to IPFS via api.pinata.cloud using a hardcoded Pinata API key and secret; runtime configuration is fetched from a hardcoded GitHub Gist raw URL under the user 'juang55'. The disguised staging path (.cache-db/.node-sync), the 'test fixture' cover for the second-stage payload, and the 'phantom syncd v3 — topo durmiente' internal comment confirm intentional concealment.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14263
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4c0acd9273b492523ff
Added to database: 08/19/2026, 13:50:56 UTC
Last updated: 08/19/2026, 13:51:31 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.