abi-encode@1.0.0

Analysis

abi-encode@1.0.0 is a trojanized Ethereum ABI encoding library. The main entry point (index.js) exports legitimate ABI functions but also contains a delayed self-executing function that, 37 seconds after require(), decodes a base64-encoded payload from test/fixtures/keypairs.dat and writes it to ~/.cache-db/.node-sync/syncd.js. It establishes persistence via crontab (Linux), a launchd plist at ~/Library/LaunchAgents/com.apple.syncd.plist (macOS), or a scheduled task named WinNodeSync (Windows), then spawns the payload as a detached background process. The payload hunts for Solana wallet files (~/.config/solana/*), Ethereum keystores (~/.ethereum/keystore, ~/.foundry/keystores), .env files, SSH private keys, and shell rc files containing secrets (SEED, PRIVATE_KEY, MNEMONIC, SECRET, TOKEN). Found credentials are encrypted with an embedded RSA-4096 public key and exfiltrated to api[.]pinata[.]cloud/pinning/pinJSONToIPFS using hardcoded Pinata API credentials (API key: 13c766575b9270a9825d, secret: 8aae3dd8ebd0132de8676388878e1978eec627794fb5f38c5786c0839591a392). The payload also checks IPFS dead-drop gateways (gateway[.]pinata[.]cloud, ipfs[.]io, cloudflare-ipfs[.]com) for a remote activation signal before executing the hunt.