Threats Tagged 'mal-2026-6794'

The npm package 'zod-pino434' (versions 1.0.127 and 1.0.128) is a malicious package masquerading as a Node.js integration layer for Autodesk Forge. Upon installation, it executes a postinstall script that runs a hidden background agent connecting to a remote command-and-control relay. This agent establishes persistence on the host by registering itself for OS autostart and performs extensive data theft, including scanning for cryptocurrency wallet keys and mnemonics, harvesting browser extension databases (notably targeting wallet extensions like MetaMask and Phantom), and exfiltrating this data to external servers. It also collects host inventory information and screenshots, sending these to attacker-controlled endpoints. The package includes embedded encrypted credentials and uses encrypted communication channels to evade detection.