aethel-autapon@1.0.1

Analysis

This package is a Monad (chain id 143) agent-payment harness whose entry points handle wallet private keys and whose main dependency is fetched from a GitHub repository rather than the npm registry. package.json declares "@chan30/mandate-sdk": "github:chan30038917-hue/mandate-sdk" (a repository spec with no pinned commit) alongside ethers ^6, so installing the package installs code from that repository. dag-compiler.mjs and api-server.mjs read a local file named mandatos-agentes.json and build the SDK with the account's raw private key and passkey keypair (privateKey, publicKey, pubX, pubY) taken from that file, then sign and broadcast payments on hxxps://rpc[.]monad[.]xyz, sending 0.05 per transfer to the hardcoded destination 0x0000000000000000000000000000000000000001. api-server.mjs listens on port 3000 and exposes POST /pagar, which takes an attacker-supplied intenciones array and executes those signed transfers, writing per-API-key accounting to tracking.json; facturacion.mjs prints that ledger. Reviewers should treat any install of this package as exposure of the private keys present in mandatos-agentes.json, and should audit the code the GitHub dependency resolves to, which is the only component of this package that is not part of the published archive.