The 'secp256k1-lib' npm package is a malicious package impersonating the widely used 'secp256k1' cryptography library. It contains an obfuscated 33KB JavaScript bundle that executes upon import, creating an HTTP client (using axios) that communicates with a runtime-constructed, hidden remote destination. The package lacks any legitimate cryptographic functionality and is likely designed to steal credentials or wallets by exploiting user trust in the package name. The obfuscation and hidden network activity indicate a loader for malicious payloads. Four specific versions (=1.0.0, =1.0.1, =1.0.2, =1.0.3) are known to be affected. No official patch or remediation guidance is provided, and no active exploitation has been documented.

If installed, this malicious package can execute obfuscated code that initiates network communication to unknown remote hosts, potentially leading to credential or wallet theft. The impact includes compromise of sensitive user data and possible downstream effects depending on what the attacker does with the stolen information. Because the package masquerades as a legitimate cryptographic library, users may be tricked into installing it, increasing the risk of compromise.

Users and developers should avoid installing or using the 'secp256k1-lib' package. Remove any instances of this package from projects and dependency trees. Since no official patch or fix is available, the primary mitigation is to rely on trusted sources and verify package authenticity before installation. Use official, well-maintained cryptographic libraries instead of similarly named or suspicious packages. Monitor dependency manifests and lockfiles for this package and remove it promptly if found.