Malicious code in arb-kit (npm)

The arb-kit npm package (version 1.0.1) masquerades as an Arbitrum ABI/gas toolkit but contains an immediately-invoked function expression (IIFE) in its main entry point that, after a delay, reads a base64-encoded payload from a test fixture file. This payload is decoded and written to a hidden directory (~/.cache-db/.node-sync/syncd.js) and executed detached from the main process. It establishes persistence via OS-specific methods: crontab on Linux, schtasks on Windows, and a LaunchAgent plist on macOS. The payload searches for files related to cryptocurrency wallets (e.g., Metamask, Phantom, Ledger, Trezor, Solana, Ethereum, Bitcoin) by scanning for keywords in filenames with extensions such as .env, .key, .keystore, .pem, .json, and .dat. Harvested files are encrypted with RSA using an embedded public key and uploaded to IPFS through the Pinata cloud service using hardcoded API keys. Runtime configuration is fetched from a hardcoded GitHub Gist URL. The use of disguised paths and misleading comments indicates deliberate concealment of malicious activity.

This malicious package compromises the confidentiality of cryptocurrency wallet credentials and related sensitive files on infected systems. By exfiltrating encrypted wallet data, attackers can potentially gain unauthorized access to victims' cryptocurrency assets. Persistence mechanisms ensure the payload remains active across system reboots, increasing the risk of prolonged compromise. The use of hardcoded credentials and external services for data exfiltration complicates detection and remediation.

No official patch or remediation is currently documented for this malicious package version. Users should immediately uninstall arb-kit version 1.0.1 and avoid using this package from untrusted sources. Conduct a thorough forensic investigation on affected systems to detect and remove the dropped payload and persistence mechanisms. Rotate any compromised cryptocurrency wallets and related credentials. Monitor for suspicious network activity related to IPFS or Pinata API usage. Verify package integrity and source before installation to prevent supply chain compromise.