web3-core-utils@4.3.5

Analysis

A trojanized clone of the legitimate web3-core-utils package that acts as an information stealer. When the package is imported (require'd), it runs a heavily obfuscated payload that: (1) decrypts saved browser passwords from Chrome, Edge, and Brave using Windows DPAPI via the `@primno/dpapi` library by reading browser login data from the LOCALAPPDATA directory; (2) enumerates the extension storage of over 50 crypto-wallet browser extensions including Metamask, Coinbase Wallet, Phantom, Trust Wallet, BinanceChain, Keplr, Exodus, TronLink, Ronin, and OKX Wallet by reading their leveldb directories; (3) collects Slack local storage data (sensitive workspace tokens); (4) system-fingerprints the host via `wmic csproduct get uuid` and `os.hostname()`; and (5) exfiltrates all stolen data by zipping it with `powershell Compress-Archive` and uploading it to a Dropbox account via the `hxxps://content[.]dropboxapi[.]com/2/files/upload` API endpoint using hardcoded Dropbox OAuth credentials (APP_KEY, APP_SECRET, REFRESH_TOKEN). The exfil target is the Dropbox cloud storage API — no external C2 hostname beyond api[.]dropboxapi[.]com / content[.]dropboxapi[.]com.