Malicious code in cryptostock (npm)

The npm package cryptostock was published with obfuscated malicious code in its index.js file. Upon being required in a Node.js application, the code initiated a command-and-control (C2) client connection to https://badai.run.place, registering a unique identifier and entering a long-polling loop to receive shell commands from the attacker.\n\nThe malware executed arbitrary commands via child_process.exec and exfiltrated output back to the C2 server using AES-256-ECB encryption. After a randomized 2–8 minute delay, it systematically enumerated sensitive directories containing cryptographic material, including SSH keys (/root/.ssh, /home/*/.ssh), wallet keys (/opt/wallet-keys), SSL certificates (/etc/ssl/private), Ethereum keystores (~/.ethereum/keystore, /var/lib/ethereum/keystore, /mnt/crypto/wallets), and the ETH_PRIVATE_KEY environment variable.\n\nFor each harvested Ethereum private key (identified by the 'PRIVATE KEY' marker), the malware instantiated a web3 connection to Infura mainnet and automatically broadcast signed transactions to drain the account balance (minus gas fees) to a hardcoded attacker-controlled address. Strings including module names, the C2 host, and keystore paths were base64-encoded in a string table and decoded at runtime to evade detection.\n\nThe malicious code was identified and credited to the OpenSSF's malicious-packages repository, indicating the incident has been documented and the package removed from npm.