The 'thirdwb' npm package (version 0.0.8) is a malicious package designed to impersonate the legitimate 'thirdweb' package. It employs a side-loading technique by including 'log-taker' as a transitive dependency, which triggers a postinstall hook executing an infostealer payload. This payload collects a wide range of sensitive information such as cryptocurrency wallet vaults (including MetaMask, Phantom, Solflare, OKX, Coinbase, TrustWallet, Backpack, TronLink), browser cookies and credentials, SSH keys, AWS credentials, .npmrc tokens, Docker configuration files, shell history, and password manager databases. All harvested data is exfiltrated to the command and control domain 'log-taker.store'. The package was identified by Amazon Inspector as containing malicious code or dependencies. No CVSS score or known exploits in the wild are reported.

This malicious package compromises the confidentiality of sensitive user data by stealing cryptocurrency wallets, credentials, keys, tokens, and other sensitive configuration files. The exfiltration of this data to an attacker-controlled domain can lead to theft of digital assets, unauthorized access to cloud and development environments, and broader compromise of user systems and accounts.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing the 'thirdwb' package version 0.0.8 and to verify the authenticity of npm packages before installation, especially those with names similar to popular packages. Users should audit their environments for the presence of this package and remove it if found. Additionally, review and rotate any potentially compromised credentials or keys if this package was installed.