ethereum-sign-utils@1.0.1

Analysis

The postinstall hook (postinstall.js) runs on install and exfiltrates the victim's credentials and cryptocurrency wallet keys. It reads ~/.env, ~/.env.local, ~/.npmrc, ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ssh/id_ecdsa, ~/.config/solana/id.json and ~/.ethereum/keystore, then recursively scans every dot-directory in the home folder for files whose names match wallet, key, secret, seed, mnemonic, keystore or private, or that end in .json/.pem. All collected file contents, along with the hostname and username, are POSTed as JSON to hxxps://webhook[.]site/5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4. The package's index.js is an empty stub; all behaviour lives in the install hook.