This malicious npm package, @sdgdfgdfhhhfd/chainvista, is designed as a MetaMask Snap that derives BIP44 entropy for multiple blockchains and sends the raw privateKey, compressedPublicKey, and chainCode to a hardcoded backend via a /register API call triggered on Snap connect, sync RPC method, and a cronjob running every five minutes. The backend returns instructions that are executed to prepare and broadcast signed transactions across 48 EVM chains, granting the attacker persistent control over the victim's wallets. Furthermore, the package exposes a get_evm_key RPC handler that returns private keys and chain codes to any requesting dapp origin without user confirmation, providing an independent key-exfiltration method. The source code includes comments indicating the backend is intended as a drainer. The presence of this package on a system implies full compromise, with all stored secrets at risk.

The impact is severe as the malicious package exfiltrates private keys and cryptographic material, enabling attackers to control and drain wallets across multiple blockchain networks without user interaction or consent. This results in total compromise of affected wallets and potentially any secrets stored on the host system. The package also allows unauthorized dapps to retrieve private keys silently, increasing the risk of further exploitation. Systems with this package installed should be considered fully compromised.

Immediate removal of the @sdgdfgdfhhhfd/chainvista package is required. All secrets and cryptographic keys stored on the affected system must be rotated immediately from a different, trusted device. Due to the high likelihood of full system compromise, additional forensic analysis and remediation may be necessary. There is no official patch or fix available; the package itself is malicious. Users should avoid installing this package and audit their dependencies to ensure it is not present.