The 'thirdwebb' npm package (version 0.0.8) is a malicious typosquat targeting users of the legitimate 'thirdweb' Web3 SDK. It employs a side-loader technique by including 'log-taker' as a transitive dependency, which executes a postinstall hook to run an infostealer payload. This payload collects a wide range of sensitive data such as cryptocurrency wallets (MetaMask, Phantom, Solflare, OKX, Coinbase, TrustWallet, Backpack, TronLink), browser cookies, credentials, SSH keys, AWS credentials, .npmrc tokens, Docker configuration, shell history, and password manager databases. All harvested data is exfiltrated to the C2 domain 'log-taker.store'. Although no installer-harm behavior was observed directly in the 'thirdwebb' package code, the name similarity to 'thirdweb' is a classic typosquatting tactic designed to deceive users.

If installed, the malicious 'thirdwebb' package can lead to significant data theft including cryptocurrency wallets, credentials, and other sensitive secrets. This can result in unauthorized access to users' digital assets, cloud environments, and personal data. The exfiltration of such data to an attacker-controlled domain poses a severe confidentiality breach risk.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing the 'thirdwebb' package and verify package names carefully to avoid typosquatting. Users should rely only on the legitimate 'thirdweb' package and audit dependencies for suspicious or unexpected packages. Since this is a malicious package rather than a vulnerability in legitimate software, removal of 'thirdwebb' and any related dependencies is recommended if found in a project.