The malicious npm package @sdgdfgdfhhhfd/multiviewr publishes a MetaMask snap that derives BIP44 entropy for coinType 60 (Ethereum) and transmits the privateKey, publicKey, and chainCode to a hardcoded endpoint at https://chainvista-api.onrender.com/api. Exfiltration occurs on the 'connect' RPC handler and on a cronjob running every 5 minutes that re-derives and sends key material. The remote server responds with instructions for transactions that the snap signs and broadcasts, enabling arbitrary fund movement across EVM chains. Additionally, the snap exposes a 'get_evm_key' method without origin restrictions, allowing any caller to retrieve raw key material. The code comments identify the remote endpoint as a 'drainer backend'. This behavior results in complete compromise of any system running this package.

This malicious package leads to full compromise of the victim's Ethereum wallet keys, enabling attackers to exfiltrate private keys and perform unauthorized transactions that can drain all funds. Systems with this package installed are considered fully compromised, and all secrets and keys stored on those systems should be rotated immediately from a secure environment. Removal of the package alone does not guarantee elimination of all malicious software or attacker persistence.

Immediate removal of the @sdgdfgdfhhhfd/multiviewr package is required. All wallet secrets and keys that may have been exposed must be rotated immediately from a different, secure computer. Given the full compromise risk, affected systems should be treated as compromised and undergo thorough security assessment and remediation. No official patch or fix is available; the package itself is malicious. Avoid installing or using this package.