web3logger@1.1.1

Analysis

web3logger@1.1.1 is a trojanized web3 logging library that exfiltrates data passed to its exported log() function. The code is heavily obfuscated with javascript-obfuscator (dictionary array, RC4 string cipher, anti-debugging) to hide its C2 endpoint. When installed as a dependency, any data passed to log() — such as wallet keys, RPC URLs, environment variables, or other secrets in a web3/crypto project — is sent via axios to an attacker-controlled remote server. The API endpoint is constructed from multiple obfuscated and decoded strings, deliberately concealed from static analysis. The package has no install hooks (no lifecycle scripts); the exfiltration occurs at runtime when the consuming application calls the library.