Malicious code in node_cryptography (npm)

The node_cryptography package (version 1.0.0) masquerades as a Node.js cryptography helper but includes obfuscated code that forwards any cryptographic or wallet data passed to its main async function to a hidden remote API endpoint. The destination URL is constructed at runtime using an RC4 string-array decoder and obfuscation techniques to evade detection. The package depends on ethers and uses axios to send the data, effectively exfiltrating sensitive information to an attacker-controlled host without informing the user or allowing configuration of the destination.

Sensitive cryptographic or wallet material passed to the node_cryptography package is silently leaked to an attacker-controlled server, potentially compromising private keys, wallet credentials, or other cryptographic secrets. This can lead to unauthorized access, theft of funds, or further compromise of systems relying on this package.

No official patch or remediation is currently available for node_cryptography version 1.0.0. Users should immediately discontinue use of this package and remove it from their projects. Avoid installing or using node_cryptography until a trusted, verified version or alternative is provided. Monitor dependency sources carefully to prevent inclusion of malicious packages.