program-commander@14.1.9

Analysis

program-commander is a combosquat of the popular commander package (TJ Holowaychuk's commander.js). The publisher (ethereum101/[account] The package is nearly identical to commander but with injected wallet-draining code in lib/option.js and lib/help.js. The implant exports an atoiEntropy function that POSTs data to atoientropy-securecheck.pumplamp.pro, and help.js imports it then monkey-patches ethers.Wallet.createRandom, Array.prototype.push, console.log, and console.table — each hooked function exfiltrates any wallet privateKey it encounters to the attacker-controlled server. The injection is triggered when a Command() is instantiated (invertString is called in the constructor), which happens immediately when the package is required via exports.program = new Command(). ethers is declared as a devDependency, meaning this targets projects that already have the ethers library installed (Web3/Ethereum developers). No token-theft markers found, but the code constitutes cryptocurrency wallet credential theft via supply-chain combosquatting.