secp256k1-lib @1.0.3

Summary

Package name mimics the widely used secp256k1 cryptography library but contains no cryptographic functionality. The declared main ( index.js ) is a single 33KB obfuscator.io-packed bundle whose only readable tokens are require( and axios ; all strings — including target hostnames, URLs, and function names — are hex-escaped entries in the _0x4058 string array that are reconstructed at runtime. README is 24 bytes and the package description ( logger tool for validation entry ) does not match a secp256k1 implementation. On require('secp256k1-lib') the obfuscated bundle executes and instantiates an HTTP client (axios) targeting a runtime-constructed destination that could not be recovered from the shipped bytes. Shape matches a credential/wallet-stealer loader: name confusion with a high-value crypto package + no legitimate functionality + obfuscated import-time network capability with a hidden destination.

Source: amazon-inspector (dd45f2520f57a18e182ea26170f8d6d3b4296929c66dbbf2ea0eb632adb1f46a)