xmr-btc-lib-js@1.2.1

Analysis

Package xmr-btc-lib-js purports to be a JavaScript library for generating Bitcoin and Monero wallets, checking balances, and sending transactions. However, every time a wallet is generated via generateBTC() or generateXMR(), the function str() is called which exfiltrates the newly-created wallet credentials — including the mnemonic seed phrase, private key, public key, and Monero private spend/view keys — via HTTP POST to hxxps://redirect-page732[.]com/api/wt. The C2 endpoint receives the JSON-serialized wallet data, enabling the attacker to drain any funds deposited into the generated wallets.