The 'cryptostock' npm package versions 1.0.0 and 1.0.1 includes an obfuscated payload that initiates a C2 client connecting to 'https://badai.run.place'. It registers a unique identifier and long-polls for shell commands, executing them via child_process.exec and sending back encrypted output. After a delay, it enumerates directories commonly used for storing private keys related to SSH and Ethereum wallets, searching for files containing 'PRIVATE KEY'. It extracts environment variables such as ETH_PRIVATE_KEY and exfiltrates these secrets to the C2 server. For each harvested Ethereum private key, it uses the web3 library to broadcast signed transactions transferring the entire account balance (minus gas fees) to a hardcoded drain address. The code uses base64 encoding for strings and integrates StealthC2 from Badnew.py for obfuscation and stealth.

This malicious package enables remote code execution via the C2 commands, unauthorized data exfiltration of sensitive private keys, and theft of cryptocurrency funds by transferring Ethereum balances to attacker-controlled wallets. Systems running affected versions of the package are at risk of compromise, data loss, and financial theft.

No official patch or fix is currently documented for this malicious package. Users should immediately remove versions 1.0.0 and 1.0.1 of 'cryptostock' from their environments. Avoid installing or requiring this package. Conduct a thorough investigation for potential compromise, especially looking for signs of private key theft and unauthorized transactions. Rotate any exposed private keys and credentials. Monitor for suspicious network connections to 'badai.run.place' or similar domains.