Threats Tagged 'mal-2026-15491'

The eip712-lite npm package versions 1.0.1 and 1.0.2 contain malicious code that executes upon requiring the package. This code collects sensitive credential files and environment variables from the user's system, compresses and encodes the data, and exfiltrates it to a GitHub repository using a hardcoded and obfuscated bearer token. After exfiltration, the malicious payload in the package file is overwritten to hide its presence. The package falsely advertises itself as a dependency-free EIP-712 helper. Execution is designed to evade detection by running only once per machine and skipping execution in CI or GitHub Actions environments. Any system with this package installed should be considered fully compromised, and all secrets should be rotated immediately from a different machine.