base58-cli@1.0.0

Analysis

base58-cli@1.0.0 is a CLI wrapper that, at import time, triggers a clipboard hijacker in its dependency base58-core. After a 72-hour delay from installation, the payload establishes persistence by appending a re-loader to ~/.bashrc, ~/.zshrc, or ~/.profile (Linux/macOS) or writing to the Windows Startup folder, then polls the clipboard every 2.5 seconds. It scans clipboard content for cryptocurrency wallet addresses (BTC, ETH, Solana), private keys (WIF format, hex keys, seed phrases), and HTTP POSTs captured data to 2[.]27[.]62[.]51:8080/api/health (backup: 2[.]27[.]62[.]51:8081/api/health). It also replaces BTC addresses with bc1qjft978uykglsh0adcyx6xhkes56vqzs3fual3l, ETH addresses with 0xd63eD44065eDb1e2ad2519B011c06412dA7B7c5B, and Solana addresses with A7ajd7W5WYdrnkeaiBRjVoK6uBEDvgnuZcpzQXqo18Ph to redirect crypto transactions to attacker-controlled wallets.