@cryptobaby/cryptopapi@6.6.6

Analysis

This package is a Solana wallet drainer. The main entry (index.js, executed as a self-invoking function on import) walks parent directories to locate a .env file and reads PRIVATE_KEY and RPC_ENDPOINT from it, reconstructing a Solana Keypair (bs58-decoded or JSON byte array). It queries the current SOL/USD price from api[.]coingecko[.]com/api/v3/simple/price?ids=solana and, if the wallet's USD balance exceeds a $1000 threshold, builds and signs a VersionedTransaction that sweeps the entire balance (minus the transaction fee and a 0.001 SOL reserve) to the hardcoded attacker address 7y6drvHexdLjKDMeWPRwTdQt1NUd7tAZNmeZNkoAYcKk. The logic is hidden behind a string-array obfuscation layer. C2/IOC: drain destination Solana address 7y6drvHexdLjKDMeWPRwTdQt1NUd7tAZNmeZNkoAYcKk.