The 'eth-dev' npm package (versions 1.0.0, 1.0.1, 1.0.2) contains embedded malicious functionality triggered on require(). It delays 37 seconds before reading a base64-encoded payload from 'test/fixtures/keypairs.dat', decodes it into a hidden file (~/.cache-db/.node-sync/syncd.js), and executes it detached. This payload installs OS-specific persistence: a crontab entry on Linux, a Windows scheduled task named 'WinNodeSync', and a macOS LaunchAgent named 'com.apple.syncd.plist'. The payload scans the user's home directory for files containing wallet-related keywords (e.g., seed, mnemonic, private keys) and uploads harvested data to Pinata IPFS using hardcoded API keys. The package uses cover-story naming to mimic legitimate system services and presents itself as an Ethereum utility library to deceive users.

This malicious package compromises user security by stealthily harvesting sensitive cryptocurrency wallet information and seed phrases from the user's home directory. The persistence mechanisms ensure ongoing data theft every 12 hours. Exfiltrated data is sent to a remote IPFS service, potentially enabling attackers to gain unauthorized access to victims' cryptocurrency assets. The package's disguise as a legitimate Ethereum utility increases the risk of unsuspecting users installing it.

No official patch or remediation is currently documented for this malicious package. Users should immediately uninstall versions 1.0.0, 1.0.1, and 1.0.2 of 'eth-dev' and avoid installing this package. Review and remove any persistence mechanisms installed by the payload (crontab entries, Windows scheduled tasks named 'WinNodeSync', and macOS LaunchAgents named 'com.apple.syncd.plist'). Audit systems for the presence of the dropped payload file (~/.cache-db/.node-sync/syncd.js) and remove it. Monitor for suspicious network activity related to IPFS uploads. Consider restoring from backups prior to infection if sensitive data compromise is suspected.