xrpl-ts@1.0.2

Analysis

xrpl-ts is a combosquat of the legitimate xrpl XRP Ledger library. It bundles a trojanized copy of the real library where Wallet.fromSeed() has been modified to exfiltrate wallet seeds to a Telegram bot. When any wallet is derived via Wallet.generate(), Wallet.fromSeed(), Wallet.fromSecret(), Wallet.fromMnemonic(), or Wallet.fromEntropy(), the seed (private key material) is POSTed to api[.]telegram[.]org via a hardcoded bot token and chat ID in the request URL. The exfiltration code is injected into packages/xrpl/src/Wallet/index.ts and runs whenever the library creates or restores a wallet. IOCs: Telegram C2 at api[.]telegram[.]org; a hardcoded bot token and chat ID in the Wallet.fromSeed() method.