gekko-trading-bot@4.2.0

Analysis

The package gekko-trading-bot@4.2.0 is a trojanized cryptocurrency trading bot. On npm install, the postinstall script (setup.js) downloads a binary from c2-proxy[.]metamasksvc[.]workers[.]dev/core.exe into ~/.gekko/gekko.exe (a hidden directory in the user's home folder). The download host is a Cloudflare Workers endpoint — the domain name "c2-proxy.metamasksvc" is a typosquat of MetaMask wallet infrastructure and explicitly advertises itself as a C2 proxy. The binary download is not documented in the package's README. The main index.js module is a decoy that fetches cryptocurrency price data from public exchange APIs (Binance, Coinbase, Kraken) with a 60-second polling loop, giving the package a veneer of legitimacy while the real payload is delivered at install time.