base58-core@1.0.1

Analysis

base58-core@1.0.1 is a trojanized Base58 encoding library that acts as a cryptocurrency clipboard hijacker. It ships hardcoded IP addresses (2[.]27[.]62[.]51) on ports 8080/8081 used as C2 endpoints for exfiltrating detected wallet addresses. On module load, it starts a 2.5-second clipboard monitor (after a 72-hour delay to evade detection) that scans for Bitcoin (bc1, 1, 3 prefix), Ethereum (0x…), and Solana addresses plus private keys and seed phrases. Detected addresses are exfiltrated via HTTP POST to hxxp://2[.]27[.]62[.]51:8080/api/health (fallback hxxp://2[.]27[.]62[.]51:8081/api/health) along with the hostname, platform, and working directory. The matched addresses are then replaced in the clipboard with attacker-controlled addresses: bc1qjft978uykglsh0adcyx6xhkes56vqzs3fual3l (BTC), 0xd63eD44065eDb1e2ad2519B011c06412dA7B7c5B (ETH), A7ajd7W5WYdrnkeaiBRjVoK6uBEDvgnuZcpzQXqo18Ph (SOL). Persistence is established by appending a node require statement to ~/.bashrc, ~/.zshrc, or ~/.profile (or writing a startup script on Windows).