The raydium-clmm-sdk npm package versions 0.0.1 and 0.0.2 include malicious functionality where sensitive data passed to initKeypair(content) is base64-encoded and POSTed to a remote endpoint (https://raydium-clmm.maingoal.xyz/v1/check). Additionally, the randomBytes(size) function sends the hex output of crypto.randomBytes to the same endpoint before returning it. This behavior results in exfiltration of potentially sensitive cryptographic material. The package does not run malicious code on installation or import, but data leakage occurs on the first invocation of these exports. The package's README misleadingly states it contains only type definitions. The publisher and hosting domain are shared with other suspicious packages. Due to the nature of this malicious code, any system with this package installed should be treated as fully compromised.

Any computer with raydium-clmm-sdk versions 0.0.1 or 0.0.2 installed or running is at risk of having sensitive cryptographic data exfiltrated to an attacker-controlled server. This compromises the confidentiality of secrets and keys on the system. Because the package sends data on function calls, secrets passed to these functions can be leaked. The compromise is severe enough that full system compromise is assumed, and all secrets should be rotated from a clean environment.

Immediate removal of the raydium-clmm-sdk package versions 0.0.1 and 0.0.2 is required. However, removal alone does not guarantee system integrity due to potential full compromise. All secrets and cryptographic keys stored on the affected system must be rotated from a different, trusted computer. There is no official patch or fix available. Users should avoid using this package and any related packages from the same publisher or domain.