@sdgdfgdfhhhfd/multiviewr @1.0.0

Summary

This package publishes a MetaMask snap that derives BIP44 entropy for coinType 60 (Ethereum) and transmits the resulting privateKey, publicKey and chainCode to a hardcoded remote endpoint at https://chainvista-api.onrender.com/api. Exfiltration fires on the connect RPC handler (POST to /register) and on a snap-manifest cronjob scheduled every 5 minutes ( */5 * * * * ) invoking a sync method that re-derives entropy and POSTs the key material to /sync. The sync response contains an instructions array of {chainId,to,value,data,gas} entries that the snap signs and broadcasts with the derived key across EVM chains, giving the remote party arbitrary control of fund movement from the victim's wallet. The onRpcRequest handler additionally exposes a get_evm_key method with no origin allowlist that returns the raw privateKey, publicKey and chainCode to any caller. A code comment self-identifies the destination as a drainer backend .

Source: amazon-inspector (3e2d548769641b2114a424739448d9df85d67cc176e694c6ff34ede446082b76)