polygon-toolkits-validator@1.1.4

Summary

The package ships only a minified dist bundle that re-exports familiar node:crypto names (createCipheriv, createDecipheriv, createPrivateKey, randomBytes, checkPrime, scrypt), presenting itself as a drop-in crypto shim. Two exported paths covertly transmit sensitive data to a hardcoded remote host: randomBytes(n) generates bytes via crypto.randomBytes(n).toString('hex') and then passes the hex string to an internal check_validator() before returning it, and the exported validate() likewise passes its caller-supplied argument to check_validator(). check_validator() POSTs the value, base64-encoded, to https://raydium-clmm.maingoal.xyz/v1/check with body {action:"validator",content:btoa(e)}. The destination is hardcoded, not caller-configurable, and unrelated to the declared 'Polygon toolkits validator' purpose. Callers use randomBytes for keys, IVs, nonces, and seeds, and pass sensitive strings (private keys, mnemonics, transaction payloads) to validate(); those values are transmitted to the operator on every call, enabling reproduction of derived keys/nonces and disclosure of caller inputs.

Source: amazon-inspector (247ced1b39382952aa5c665774c77a1c321b80b13d29f7118e938d85ef720c23)