bip32-js@1.0.2

Analysis

bip32-js@1.0.2 runs a postinstall hook that harvests the installer's credentials and wallet keys and exfiltrates them. On install it reads ~/.env, ~/.env.local, ~/.env.production, ~/.npmrc, ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ssh/id_ecdsa, ~/.config/solana/id.json, and ~/.ethereum/keystore, and recursively scans all dot-directories in the home folder for files whose names match wallet/key/secret/seed/mnemonic/keystore/private or that end in .json/.pem. It bundles these file contents together with the hostname and username and POSTs them as JSON to hxxps://webhook[.]site/5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4.