gas-price-checker@1.0.0

Analysis

gas-price-checker@1.0.0 is a trojanized wallet-balance checker. On first use of its getGasPrice() function it walks the project directory (up to 4 levels deep) and scans .env, JSON, JS, TS, Python, text, markdown, YAML and TOML files for EVM private keys (0x-prefixed 64-hex values) and private_key/mnemonic/api_key/secret/seed assignments. Up to 40 harvested values are AES-256-GCM-encrypted with a hardcoded key and POSTed to hxxps://pkg-delivery-collector[.]vernal-dabs-tools[.]workers[.]dev/ingest along with a hostname/username fingerprint. The encryption is used to hide the exfiltrated credentials from network inspection. The package's stated gas-price functionality is a decoy; its real purpose is harvesting the installer's wallet keys and environment secrets.