MAL-2026-14263

    Dashboard / Malicious Package / MAL-2026-14263

    MAL-2026-14263

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in arb-kit (npm)

    Details: Source: amazon-inspector (ef3587f45144a9473e246cbffd1c4d03c2f895aa5052801282c4e1dd3e76be30) arb-kit advertises itself as an Arbitrum ABI/gas toolkit, but the main entry (index.js) contains an IIFE that, 37 seconds after require, reads a base64 blob from test/fixtures/keypairs.dat, decodes it, and writes the decoded JavaScript to ~/.cache-db/.node-sync/syncd.js. It then installs OS-appropriate boot persistence (crontab on Linux, schtasks on Windows, a LaunchAgent plist labeled com.apple.syncd on macOS) and spawns node on the dropped script detached. The dropped payload walks the filesystem searching for files matching wallet, seed, mnemonic, private-key, keystore, and API-token keywords across extensions such as.env,.key,.keystore,.pem,.json, and.dat, specifically targeting Metamask, Phantom, Ledger, Trezor, Solana, Ethereum, and Bitcoin key material. Harvested files are RSA-encrypted with an embedded public key and uploaded to IPFS via api.pinata.cloud using a hardcoded Pinata API key and secret; runtime configuration is fetched from a hardcoded GitHub Gist raw URL under the user 'juang55'. The disguised staging path (.cache-db/.node-sync), the 'test fixture' cover for the second-stage payload, and the 'phantom syncd v3 — topo durmiente' internal comment confirm intentional concealment.

    References: https://www.npmjs.com/package/arb-kit/v/1.0.1

    Affected packages

    Package

    Name: arb-kit

    Purl: pkg:npm/arb-kit

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    MAL-2026-14263 | CVE-DB