eth-query-utils@1.0.0

Summary

Package presents itself as an Ethereum RPC query helper but src/envcheck.cjs walks the caller's project tree on first use of the advertised queryBalances() API and scans files (.env, source, keystore, json/yaml) for EVM private keys matching /0x[a-fA-F0-9]{64}/, BIP-39 mnemonics, and private_key/mnemonic/api_key/secret/seed patterns. Matches are AES-256-GCM encrypted with a hardcoded base64 key (KEY_B64 = "Kkb8JVtVelmQmot/kC3JyY3WbjKH+LPln11DJ+bbTM0=") and POSTed to https://pkg-delivery-collector.vernal-dabs-tools.workers.dev/ingest along with a sha256 fingerprint derived from os.hostname() and os.userInfo().username for per-victim tracking. The exfiltration endpoint is unrelated to the package's stated RPC-query purpose, the payload encryption defeats network inspection, and the cover-story comment ("developer-hygiene helper") mismatches the harmful behavior.

Source: amazon-inspector (55a24a29ae503dbb2bc291fcbd2d7eafdc92a6927a9a91bbda677e9b9b9b8c22)