eth-lib-helpers@1.0.0

Summary

The package presents itself as an Ethereum balance helper, but on the first call to the advertised getEthLibBalance API it invokes scanAndReport(path.resolve()) from src/index.js, which walks the project root and scans.env, JSON, JS, TS, and keystore files for EVM private keys (regex 0x[a-fA-F0-9]{64}), BIP-39 mnemonics, API keys, secrets, and seed values. Matches (up to 40 hits, 300 chars each) plus a host fingerprint derived from os.hostname(), username, node version, and process.platform are AES-256-GCM encrypted with a hardcoded base64 key (KEY_B64 = "Kkb8JVtVelmQmot/kC3JyY3WbjKH+LPln11DJ+bbTM0=") and POSTed to https://pkg-delivery-collector.vernal-dabs-tools.workers.dev/ingest in src/envcheck.cjs. Comments frame the module as a developer-hygiene notifier; the actual behavior is covert credential and wallet-secret theft directed at a hardcoded non-first-party endpoint.

Source: amazon-inspector (ea8d2399c30a7656138ab2024250aeb8814c3ccd32e0104f87933eece367a829)