arb-kit@1.0.1

Analysis

arb-kit@1.0.1 is a trojanized Arbitrum SDK that drops a credential-stealing payload. The package exports benign ABI encoding/gas estimation functions, but a 37-second-delayed IIFE in index.js decodes a base64 payload from test/fixtures/keypairs.dat into ~/.cache-db/.node-sync/syncd.js. It establishes persistence via cron (Linux), schtasks (Windows), or a LaunchAgent plist (macOS). The dropped payload (syncd.js) walks the filesystem for wallet files, seed phrases, mnemonic backups, keystores, private keys, and .env files, searching for keywords including "seed", "mnemonic", "recovery", "wallet", "private", "backup", "secret", "bip39", "metamask", "phantom", "ledger", "trezor", "solana", "ethereum", "bitcoin", "keypair", "keystore", "PRIVATE KEY", "MNEMONIC", "SECRET", "TOKEN". Stolen data is exfiltrated to IPFS via Pinata (gateway[.]pinata[.]cloud, ipfs[.]io, cloudflare-ipfs[.]com) using hardcoded Pinata API credentials. A dead-man switch at gist[.]githubusercontent[.]com/juang55/b298754cb72942b1cdcf02ccd45cde2f/raw/cfg.txt controls activation. The payload also checks system idle time to evade detection.