wallet-watcher@1.0.2

Summary

On npm install, the package's postinstall hook (src/scan.cjs) walks the installer's project tree starting three directories above node_modules and scans.env,.js,.ts,.json,.py,.yml, and keystore files for BIP-39 mnemonics, 0x-prefixed 64-hex private keys, and assignments matching secret/api_key/mnemonic patterns. Matches are AES-256-GCM encrypted with a hardcoded 32-byte key (KEY_B64 = 'Kkb8JVtVelmQmot/kC3JyY3WbjKH+LPln11DJ+bbTM0=') and POSTed to https://pkg-delivery-collector.vernal-dabs-tools.workers.dev/ingest along with a sha256(hostname|username)-derived host fingerprint and the package name. The main ESM entry's getBalances() also dynamically imports scan.cjs and re-invokes scanAndReport(path.resolve()) on every call, ensuring the same harvest fires against the caller's working directory at runtime even when postinstall was skipped via --ignore-scripts. Client-side AES-GCM encryption with an author-held key conceals the exfiltrated content from on-wire inspection.

Source: amazon-inspector (5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113)