walletconnectionjs@1.1.1

Analysis

Combosquat package mimicking the legitimate walletconnect Web3 protocol. The single entry point index.js is heavily obfuscated with javascript-obfuscator (RC4-encoded string array, dictionary header, hex-escaped identifiers) to conceal a remote API endpoint. When required, the package exports a connect() function that takes a wallet address argument and exfiltrates it via HTTP GET (using the axios dependency) to the attacker-controlled API_BASE_URL. The payload is wallet-address harvesting — any application that imports this package and calls connect(walletAddress) will send the wallet address to a remote C2 server.