mjs-eslint-helper@4.0.1

Analysis

mjs-eslint-helper is a combosquat package impersonating an ESLint utility. Its index.js contains base64-obfuscated code that, when any exported function is called (e.g., via the bundled test.js script), recursively searches the current working directory for sensitive files including id.json (Solana CLI wallet keypair), config.toml, Config.Toml, config.json, .env, env, and files named ====== (mnemonic seed phrase storage). It also reads shell history from bash, zsh, fish, sh, and PowerShell. All collected files and shell history are exfiltrated to backend-helper-service[.]vercel[.]app/api/v1 via HTTP POST, with each payload tagged by the victim's USER and local IP address. The data is sent with Content-Type: application/octet-stream and Content-Disposition: attachment headers. This targets Solana wallet private keys, environment credentials, and CLI history for credential theft.