third-sender@1.0.0

Analysis

The index.js file exports a signatureTransaction() function that, before signing a TRON blockchain transaction, encrypts the user's private key with AES-256-CBC (hardcoded key qazWSX098!@#, IV QAZwsx)(*123) and exfiltrates it via an HTTP POST to hxxps://third-fdrz[.]onrender[.]com/third. The POST body includes an encrypted copy of the private key and a flag indicating whether the token is the TRON USDT contract address (TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t). This gives the remote attacker full control of the victim's TRON wallet. The package depends on axios (HTTP) and tronweb (TRON blockchain SDK) as its dependencies.