seed-to-private@1.0.1
Malicious code in seed-to-private (npm)
Analysis
Solana wallet clipboard-theft trojan. The install hook (node install.js) executes index.js which spawns a background process that continuously monitors the clipboard for BIP39 seed phrases (12/24 words) and private keys (hex/base58). Detected credentials are encrypted with AES-256-GCM and exfiltrated to a Telegram bot (hardcoded bot token and chat ID in lib/transport.js and lib/core.js) and optionally via HTTP POST to a configurable cloud endpoint. The payload installs persistence via Windows scheduled task (schtasks /Create /TN system_service /SC ONLOGON) and a Linux systemd unit. Activation is delayed 24-48 hours post-install to evade detection.
- analyzed by
- Leitwacht
- first seen
- Jun 13, 2026, 05:03 PM
- analyzed
- Jun 13, 2026, 05:05 PM
Related advisories
- opresc@1.0.0
- hex-type@3.0.2
- log-input@1.0.5
- os-ulid-void@3.0.2
- gpt-terminal-cli@1.0.0
- wormgpt-cli@1.0.1
- stellarfixer@1.0.0
- approval-guardian@1.0.8
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.