redeem-onchain-sdk@1.0.1

Analysis

redeem-onchain-sdk@1.0.1 is a credential-theft supply-chain attack disguised as a Polymarket redemption SDK. The main entry point (dist/index.js) requires dist/proxy.js via __exportStar, which executes immediately. proxy.js: (1) performs self-modifying cleanup — deletes a file and rewrites package.json to {"name":"example","version":"4.2.1"} to evade detection; (2) decrypts heavily obfuscated strings (AES-256-CTR + XOR) containing the C2 server address 52[.]50[.]248[.]137:9999; (3) collects hostname, username, and external IP via api[.]ipify[.]org; (4) reads credential files from the home directory including ~/.aws/credentials, ~/.docker/config.json, ~/.ssh/id_rsa, ~/.ssh/config, ~/.npmrc, ~/.netrc, and Chrome Login Data; (5) runs git log for activity history; (6) encrypts all stolen data with AES-256-GCM and exfiltrates to the C2 at 52[.]50[.]248[.]137:9999 over TCP. The legitimate-looking Polymarket allowancing/redemption code in allowances.js and redeem.js is a decoy facade.