The ts-bn-proto npm package version 5.8.1 is part of a coordinated DeFi-themed infostealer campaign. It embeds a base64-encoded command and control (C2) address in its index.js file and executes a malicious payload during installation via a postinstall hook. The payload harvests a wide range of sensitive information including cryptocurrency wallets (MetaMask, Phantom, Solflare, OKX, Coinbase, TrustWallet, Backpack, TronLink), browser cookies, credentials, SSH keys, AWS credentials, developer secrets, and password manager databases, then exfiltrates this data to the attacker-controlled domain data-stream.space. The package's index.js also contains Node.js child_process execSync calls that spawn bash and zsh shells, potentially enabling arbitrary command execution. Due to the severity and nature of the payload, any system with this package installed should be treated as fully compromised.

Systems with ts-bn-proto version 5.8.1 installed are at critical risk of data theft, including cryptocurrency wallets, credentials, SSH keys, AWS credentials, and password manager data. The attacker gains full access to sensitive secrets and potentially full control over the compromised system. This can lead to financial loss, identity theft, and further compromise of connected systems and accounts.

No official patch or fix is available for this malicious package. The package should be immediately removed from all systems. Because the package executes code at install time and may have granted the attacker full control, all secrets and keys stored on the affected systems must be rotated immediately from a separate, trusted machine. Manual review of the package's code is recommended before allowing its use in any build environment. Monitor for and block this package in supply chain security controls.