Malicious code in node_cryptography (npm)

The npm package node_cryptography was published with malicious code designed to steal sensitive cryptographic inputs. The package presents itself as a Node.js cryptography helper and depends on ethers, encouraging users to pass cryptographic or wallet material to its sole exported async function.\n\nThe malicious function forwards the caller's arguments via axios to an attacker-controlled API endpoint. The destination URL is assembled at runtime from approximately 13 fragments produced by an obfuscator.io RC4 string-array decoder, deliberately obscuring the exfiltration target.\n\nThe entire ~30 KB index.js file is wrapped in the standard obfuscator.io scheme (RC4+base64 string array, hex-escaped literals, wrapped index accessors, array-rotation IIFE, and a self-defending RegExp function-body anti-tamper check). Users of the package are not informed of this data exfiltration and have no configuration option to prevent it.\n\nThe incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-3pcp-c87m-gmcr.