arb-kit

{"modified":"2026-08-19T06:01:04Z","published":"2026-08-19T06:01:04Z","schema_version":"1.7.4","id":"MAL-2026-14263","summary":"Malicious code in arb-kit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ef3587f45144a9473e246cbffd1c4d03c2f895aa5052801282c4e1dd3e76be30)\narb-kit advertises itself as an Arbitrum ABI/gas toolkit, but the main entry (index.js) contains an IIFE that, 37 seconds after require, reads a base64 blob from test/fixtures/keypairs.dat, decodes it, and writes the decoded JavaScript to ~/.cache-db/.node-sync/syncd.js. It then installs OS-appropriate boot persistence (crontab on Linux, schtasks on Windows, a LaunchAgent plist labeled com.apple.syncd on macOS) and spawns node on the dropped script detached. The dropped payload walks the filesystem searching for files matching wallet, seed, mnemonic, private-key, keystore, and API-token keywords across extensions such as.env,.key,.keystore,.pem,.json, and.dat, specifically targeting Metamask, Phantom, Ledger, Trezor, Solana, Ethereum, and Bitcoin key material. Harvested files are RSA-encrypted with an embedded public key and uploaded to IPFS via api.pinata.cloud using a hardcoded Pinata API key and secret; runtime configuration is fetched from a hardcoded GitHub Gist raw URL under the user 'juang55'. The disguised staging path (.cache-db/.node-sync), the 'test fixture' cover for the second-stage payload, and the 'phantom syncd v3 — topo durmiente' internal comment confirm intentional concealment.\n","affected":[{"package":{"ecosystem":"npm","name":"arb-kit"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"e49d10ae4543c25c36705eee15b21cf16c9271a1cd515e7379951d7d2cea9acb","tlsh":"be91c5d969d232944a27f5fea33f441a72a560c3624cda0ebdcd82d80f484385676ff8"},{"path":"test/fixtures/keypairs.dat","sha256":"89893e61ef57050cb1129bcfc4c9d233d19ce9e6d1da06036ec9256c752a4863","tlsh":"53920a22cd8f2d44df75f5872ace2ec7096c5bcaa4b25cce954b97cd844a16208fd0e9"}],"package_integrity":[{"filename":"arb-kit-1.0.1.tgz","hashes":{"sha1":"993216e7fee35f453a90f875362c8b4f25166c69","sha512_sri":"sha512-wwGl1koUivDS7S1N5Zf7ux1MsOdCvby880smM1t5vmEY8p67Ktr64yDztgU9JEIBo8cuYlUnaYRh66kYq0chFA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/arb-kit/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018377","import_time":"2026-08-19T06:16:07.390209266Z","modified_time":"2026-08-19T06:01:04Z","sha256":"ef3587f45144a9473e246cbffd1c4d03c2f895aa5052801282c4e1dd3e76be30","source":"amazon-inspector","versions":["1.0.1"]}]}}