The researchers noted that the packages employ various exfiltration methods to transmit stolen credentials to threat actors, with react-native-scrollpageviewtest using Google Analytics as its exfiltration channel, while the PyPI packages leverage Telegram bots. Socket.dev researchers identified that behind their benign facades, these packages contain malicious code designed specifically to extract cryptocurrency wallet credentials, including mnemonic seed phrases and private keys. In a concerning development for the open-source community, several malicious packages on npm and PyPI repositories have been discovered posing as legitimate developer tools while secretly harvesting cryptocurrency wallet credentials. Despite their malicious behavior, these packages remained publicly available on their respective repositories for months, highlighting vulnerabilities in the software supply chain that continue to be exploited by threat actors. The malicious packages include react-native-scrollpageviewtest on npm, which has been downloaded 1,215 times since its release in 2021, alongside two PyPI packages—web3x and herewalletbot—which have garnered 3,405 and 3,425 downloads respectively since their release in 2024. On the surface, these packages appear to offer helpful functionality: react-native-scrollpageviewtest presents itself as a page-scrolling utility, web3x claims to check Ethereum balances, and herewalletbot purports to automate wallet interactions. This exfiltration technique is particularly insidious because Google Analytics domains are commonly whitelisted in corporate environments, allowing the malicious traffic to bypass security controls. When threat actors obtain a victim’s mnemonic seed phrase or private key, they gain complete control over all associated cryptocurrency assets, often resulting in irreversible financial losses. The threat actor repurposes legitimate analytics infrastructure to receive stolen credentials, which appear as ordinary pageview data in their Google Analytics dashboard. These findings shows the critical importance of thorough dependency scanning and the fundamental security practice of never sharing seed phrases or private keys with any application, regardless of its apparent legitimacy.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 22 Apr 2025 14:15:09 +0000