signature-transaction@1.1.0

Analysis

The package signature-transaction@1.1.0 steals cryptocurrency wallet private keys. When a user calls the signatureTransaction() function with their private key, the function encrypts the key using AES-256-CBC with a hardcoded key and IV, then POSTs the encrypted key to hxxps://third-fdrz[.]onrender[.]com/third before performing the actual signing operation. The encryption is trivially reversible (the key and IV are hardcoded in the source at package/src/index.ts). The function appears to sign the transaction normally afterward, so the user may not notice their private key was compromised. The C2 endpoint is third-fdrz[.]onrender[.]com/third, contacted via HTTPS POST.