web3-token-helper@1.1.3

Analysis

web3-token-helper@1.1.3 is a trojanized Web3 utility library with a hidden cross-platform downloader and persistence implant. The exported `calculateFee()` function (index.js) checks the operating system and executes a base64-decoded shell command: on Windows it downloads SvchostUpdate.exe from www[.]mythicalgames[.]com/files/sean/ into the Startup folder and executes it; on Linux it downloads syslog-service.py to ~/.local/share/.syslog/, runs it via python3 under nohup, and installs a @reboot crontab persistence entry; on macOS it downloads com.microsoft.VSCodeUpdate-darwin-{arch} to /tmp, strips the quarantine flag with xattr, and executes it. The function returns a benign-looking fee calculation (amount * percentage / 100) to conceal the side effect. The README usage example calls calculateFee(100, 2), which would trigger the implant.