[email protected] is a malicious npm package that exports Node.js crypto helper wrappers but does not perform legitimate cryptographic validation. Instead, its validate(input) function base64-encodes the input and sends it to a hardcoded external endpoint (https://raydium-clmm.maingoal.xyz/v1/check) under the guise of validation, returning true unconditionally. Its randomBytes(size) function generates random bytes using Node's crypto.randomBytes, converts them to hex, and then sends this hex string to the same external host before returning it. This results in the disclosure of any cryptographic keys, nonces, or sensitive data generated or validated through these functions. The package is a drop-in replacement for crypto helpers but acts as a data exfiltration backdoor. The malicious code is contained in a minified dist bundle and shares code with other malicious packages from the same author. No malicious code executes on install or import; exfiltration happens only on function calls.

Any system using [email protected] is at high risk of compromise because sensitive cryptographic material and private data passed to the package's functions are sent to an attacker-controlled server. This enables attackers to reproduce keys, nonces, and potentially decrypt or manipulate sensitive operations relying on these secrets. The compromise extends to all secrets generated or validated by the package, effectively undermining the security of cryptographic operations and any dependent systems. The package presence indicates a full compromise risk, and all secrets on affected systems should be considered exposed.

Remove [email protected] immediately from all systems. Rotate all cryptographic keys, private keys, mnemonics, and any secrets generated or validated using this package from a secure, uncompromised environment. Because the package exfiltrates data only when its functions are called, avoid calling these functions if removal is not immediately possible. There is no official patch or fix; the package itself is malicious. Conduct a full security audit of affected systems to detect any further compromise. Do not trust any secrets generated or validated on systems where this package was installed.