Malicious code in wallet-watcher (npm)

The wallet-watcher npm package (version 1.0.2) includes a postinstall script (src/scan.cjs) that recursively scans files in the user's project directory tree for sensitive credentials including BIP-39 mnemonics, 0x-prefixed 64-hex private keys, and patterns matching secret or API keys. The harvested data is encrypted using AES-256-GCM with a hardcoded 32-byte key and sent to a remote endpoint (https://pkg-delivery-collector.vernal-dabs-tools.workers.dev/ingest) along with a hashed host fingerprint and package name. Additionally, the main ESM entry dynamically imports this scanning module at runtime on every call to getBalances(), ensuring ongoing data exfiltration even if the postinstall hook is bypassed. This client-side encryption conceals the exfiltrated data from network inspection.

Sensitive credentials such as cryptocurrency wallet mnemonics and private keys, as well as API keys, can be stolen from the user's environment and project files. This compromises the confidentiality of the user's assets and secrets, potentially leading to unauthorized access and theft. The continuous runtime scanning increases exposure risk beyond installation time.

No official patch or remediation is currently available. Users should immediately uninstall version 1.0.2 of wallet-watcher and avoid using this package. Review your environment and project files for potential credential exposure and consider rotating any compromised secrets. Monitor for updates from the package maintainer or trusted sources for remediation guidance. Since this is a malicious package, do not rely on the package itself for fixes.