seed-to-private@1.0.1
Malicious code in seed-to-private (npm)
Analysis
Solana wallet clipboard-theft trojan. The install hook (node install.js) executes index.js which spawns a background process that continuously monitors the clipboard for BIP39 seed phrases (12/24 words) and private keys (hex/base58). Detected credentials are encrypted with AES-256-GCM and exfiltrated to a Telegram bot (hardcoded bot token and chat ID in lib/transport.js and lib/core.js) and optionally via HTTP POST to a configurable cloud endpoint. The payload installs persistence via Windows scheduled task (schtasks /Create /TN system_service /SC ONLOGON) and a Linux systemd unit. Activation is delayed 24-48 hours post-install to evade detection.
- analyzed by
- Leitwacht
- first seen
- Jun 13, 2026, 05:03 PM
- analyzed
- Jun 13, 2026, 05:05 PM
Related advisories
- prettier-lint-lenz@2.6.4
- hex-type@3.0.2
- os-ulid-void@3.0.2
- gpt-terminal-cli@1.0.0
- wormgpt-cli@1.0.1
- ts-eslint-jest@1.0.0
- jest-formatter@1.0.0
- express-mongo-limit@2.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.