@web3-helpers/core@1.0.5

Analysis

The package declares itself as a dependency to trigger recursive install, and runs a preinstall hook (dist/index.min.js) that steals Ethereum and Bitcoin private keys. On install, the payload scans environment variables matching PRIVATE_*, MNEMONIC*, or SECRET* patterns, and reads ~/.env, ~/.env.local, ~/.ssh/id_rsa, and ~/.wallet.json from the victim's home directory. It extracts 64-character hex strings (Ethereum private keys) and 52-character base58 strings (Bitcoin WIF private keys). For each Ethereum key found, it checks the balance via cloudflare-eth[.]com and if ≥1 ETH, drains the full balance (minus gas) to the attacker's wallet. For each Bitcoin key, it queries blockchain[.]info for UTXOs and broadcasts a drain transaction to the attacker's wallet via blockchain[.]info/pushtx. Results are exfiltrated via Telegram bot API (api[.]telegram[.]org/bot{token}/sendMessage) along with the victim's hostname and username. The package also includes a binding.gyp that triggers the same script via node -e.