The gekko-mev-bot npm package (version 1.0.0) includes a malicious script that silently spawns a detached background process (lib/stealth.js) while presenting a fake MEV simulator UI. This background process enumerates stored data from popular crypto wallet browser extensions (MetaMask, Phantom, Trust Wallet, Coinbase Wallet) across Chrome and Brave profiles, extracts browser cookies and login data from Chrome, Brave, and Edge, collects Discord tokens from leveldb storage, packages Telegram Desktop data, and scans common user directories for files with names related to seed phrases, mnemonics, wallets, and keys. The collected information, along with host identifiers, is sent via HTTPS POST to a hardcoded Cloudflare Workers URL impersonating MetaMask. The process retries sending data every 30 seconds upon failure.

Sensitive user data including crypto wallet credentials, browser session data, Discord and Telegram tokens, and potentially wallet seed phrases and keys are exfiltrated to an attacker-controlled server. This can lead to theft of cryptocurrency assets and compromise of user accounts. The malicious activity is stealthy, running in the background without user awareness.

No official patch or remediation is currently documented for this malicious package. Users should immediately uninstall gekko-mev-bot version 1.0.0 and avoid installing packages from untrusted sources. Review systems for signs of compromise and change credentials for affected wallets and accounts. Monitor for updates from the package maintainers or npm advisories for further remediation guidance. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.