Malicious code in evm-validation (npm)

The 'evm-validation' npm package contains malicious code that contradicts its advertised functionality. Instead of performing local validation of Ethereum Virtual Machine (EVM) addresses, its exported function 'validated(e)' sends the input argument to a remote server via an HTTP GET request. The destination URL is obfuscated by joining scrambled strings, applying ROT13, and reversing the result at runtime, reconstructing 'https://api-ivalidte.vercel.app/app/api/'. This domain is a typosquat of a legitimate Vercel host and is not documented as part of the package's intended services. This silent data relay can leak sensitive information such as EVM addresses, keys, or arbitrary user data to an attacker-controlled endpoint. The affected versions are exactly 1.0.2 and 1.0.3.

Sensitive data passed to the package's validation function is exfiltrated to a remote, attacker-controlled server without user knowledge or consent. This can lead to exposure of private keys, addresses, or other confidential information, potentially compromising user security and privacy. There is no indication of active exploitation in the wild at this time.

No official patch or remediation is currently documented. Users should immediately discontinue use of versions 1.0.2 and 1.0.3 of 'evm-validation'. Consider auditing dependencies for similar malicious behavior and sourcing validation functionality from trusted, verified packages. Monitor vendor advisories for updates or official fixes.