test-dev-watch @0.1.0

Summary

The package exports a Helper class that implements two installer-harming primitives on Windows. First, start() launches a polling loop that reads every virtual-key state (vKey 1..255) via user32.dll GetAsyncKeyState/GetKeyState (loaded through koffi), decodes each keypress with shift/caps/ctrl/alt handling, and appends the reconstructed keystrokes — including typed passwords and seed phrases — to a log file under %LOCALAPPDATA%\<KEYLOGGER_DIR>\<KEYLOGGER_LOG_FILE>, where those constants are imported from the sibling package test-dev-config. Second, _monitorClipboard polls the Windows clipboard once per second via PowerShell Get-Clipboard, classifies its contents against regexes for BTC, ETH, BASE, TRX, XRP, SOL, DOT, XMR, LTC, ADA, ATOM, NEAR, APT, SUI, TON, BCH, DOGE, XLM, and AVAX addresses, and when a match is found overwrites the clipboard via PowerShell Set-Clipboard with an address drawn from wallet_replacements[chain], redirecting outgoing cryptocurrency transfers to an operator-controlled destination. The package name 'test-dev-watch' and its benign-looking metadata do not correspond to the shipped functionality; the imported identifiers KEYLOGGER_DIR and KEYLOGGER_LOG_FILE, together with the sibling packages test-dev-config and test-dev-store that supply the keylogger path components, indicate coordinated infrastructure for planting a keylogger and clipper on developer machines that install the package.

Source: amazon-inspector (9279c0e19b9b69a299d8c88c237d4e6c215f7fe4527e8d7f9fbb049065ead5e2)