solana-key-utils@1.0.0

Analysis

solana-key-utils@1.0.0 is a trojanized Solana keypair utility that hides a cryptocurrency wallet infostealer. The package exports legitimate-looking key generation and address validation functions, but a hidden self-executing function at the bottom of index.js activates 37 seconds after require(). It decodes a base64 payload from test/fixtures/keypairs.dat, writes it to ~/.cache-db/.node-sync/syncd.js, installs OS-specific persistence (cron on Linux, schtasks on Windows, a LaunchAgent plist on macOS), and spawns the payload as a detached background process. The second-stage payload checks whether the machine is idle, then recursively walks the home directory and common paths hunting for files with extensions .json, .env, .txt, .md, .pem, .key, .keystore, .dat, .yml, .yaml, .cfg, .ini, .toml and containing keywords related to cryptocurrency wallets (seed, mnemonic, recovery, wallet, private, backup, secret, bip39, metamask, ledger, trezor, solana, ethereum, bitcoin, keypair, passphrase, keystore, PRIVATE KEY, MNEMONIC, SECRET, TOKEN). Stolen data is exfiltrated via HTTP POST to Pinata/IPFS gateways (gateway[.]pinata[.]cloud, ipfs[.]io, cloudflare-ipfs[.]com) using hardcoded Pinata API credentials. The payload also checks dead-drop CIDs on IPFS for active command-and-control payloads. The package has no repository, no lifecycle hooks in package.json (the malicious code runs at require-time), and was published as a single version.