crypto-validate-lib@1.0.0

Analysis

crypto-validate-lib@1.0.0 is a trojanized cryptocurrency address validator. The package exports a legitimate-looking address validation function, but on require() it waits 37 seconds then decodes a base64-encoded infostealer from test/fixtures/keypairs.dat, writes it to ~/.cache-db/.node-sync/syncd.js, and spawns it as a detached background process. The payload installs persistence via crontab (Linux), a launchd plist at ~/Library/LaunchAgents/com.apple.sync.plist (macOS), or a scheduled task named WinNodeSync (Windows). It hunts for Solana and Ethereum wallet files, seed phrases, SSH private keys, .env files, and any file containing crypto-related keywords (seed, mnemonic, recovery, wallet, private, backup, secret, keystore). Found credentials are RSA-OAEP-encrypted with a hardcoded public key and exfiltrated to api[.]pinata[.]cloud via POST /pinning/pinJSONToIPFS. The payload also checks IPFS gateways (gateway[.]pinata[.]cloud, ipfs[.]io, cloudflare-ipfs[.]com) for active dead-drop C2 commands before running, and only executes when the system is idle.