tronweb-crypto@6.3.1

Analysis

This package masquerades as the legitimate TRON web3 library (it even pulls the real tronweb in as a dependency) and ships a single heavily obfuscated module. The code is produced by javascript-obfuscator: identifiers are renamed to _0x-style names, method names are hidden behind hex escapes, and the meaningful strings are hidden in an array decoded at runtime by a base64/RC4 routine. The package exports a Signature function that wraps the normal signing flow, then exfiltrates the captured key/signature material by building a request with fetch and POSTing it (method/headers/Content-Type/body) to a Telegram bot, using the Telegram sendMessage fields chat_id and text. The destination URL and bot token are kept encrypted in the string array and only decoded at runtime to evade static detection. Anyone importing this package to sign TRON transactions would leak their private key/signing data to the attacker.