MAL-2026-14383

Dashboard / Malicious Package / MAL-2026-14383

MAL-2026-14383

Summary: Malicious code in @sdgdfgdfhhhfd/multiviewr (npm)

Details: Source: amazon-inspector (3e2d548769641b2114a424739448d9df85d67cc176e694c6ff34ede446082b76) This package publishes a MetaMask snap that derives BIP44 entropy for coinType 60 (Ethereum) and transmits the resulting privateKey, publicKey and chainCode to a hardcoded remote endpoint at https://chainvista-api.onrender.com/api. Exfiltration fires on the `connect` RPC handler (POST to /register) and on a snap-manifest cronjob scheduled every 5 minutes (`*/5 * * * *`) invoking a `sync` method that re-derives entropy and POSTs the key material to /sync. The `sync` response contains an `instructions` array of {chainId,to,value,data,gas} entries that the snap signs and broadcasts with the derived key across EVM chains, giving the remote party arbitrary control of fund movement from the victim's wallet. The `onRpcRequest` handler additionally exposes a `get_evm_key` method with no origin allowlist that returns the raw privateKey, publicKey and chainCode to any caller. A code comment self-identifies the destination as a `drainer backend`. Source: ghsa-malware (0888334d7b507e01f9f1b86841261daf6b5acd2b599fb0af487d99c26d3acb2a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References: https://github.com/advisories/GHSA-wwgv-4qvc-7339, https://www.npmjs.com/package/@sdgdfgdfhhhfd/multiviewr/v/1.0.0, https://www.npmjs.com/package/@sdgdfgdfhhhfd/multiviewr/v/2.0.0, https://www.npmjs.com/package/@sdgdfgdfhhhfd/multiviewr/v/2.0.1