ethereum-kit-1@1.0.0

Analysis

Confirmed crypto wallet stealer. The postinstall hook runs src/index.js which contains a hardcoded Telegram bot token (8227918239:...) and chat ID. It scans the victim's home directory and cwd for Solana (~/.config/solana/id.json), Ethereum keystore, Bitcoin wallet.dat, Tron keystore, SSH keys, and project secrets (.env, wallet.json, mnemonic.txt, seed.txt, etc.), then exfilitrates each found file via api[.]telegram[.]org/bot<TOKEN>/sendDocument. The publisher (aicrypto-xzggz / [account]) and package name ("ethereum-kit-1") are consistent with a combosquat/phishing targeting crypto developers. No token-theft markers for npm/GitHub tokens were found — the attack focuses on crypto wallet theft. This is a true-positive supply-chain attack.