A malicious npm package introduced through a tampered pull request to a popular VS Code extension carries two attack components: a PowerShell-based downloader that fires silently on npm install, and a fake wallet utility that harvests Ethereum keystore credentials from developers who call it as a helper. Armando's analysis of keythereum-utils v1.2.2 -- published June 19, 2025 under the npm handle 1xlab -- reveals that the package name mimics the legitimate keythereum library to deceive code reviewers. The package accumulated 571 total downloads across its catalog before npm security quarantined it.
Key Findings
- Malicious version: v1.2.2, published 2025-06-19; no clean predecessor exists -- all versions in the catalog are malicious
- Entry point: postinstall lifecycle hook fires automatically on npm install
- Targets: Windows developer machines and CI/CD pipelines (no platform guard in this version)
- Payload: obfuscated PowerShell downloader fetching a batch file from Catbox; companion infostealer harvesting Ethereum wallet credentials
- Evasion: windowsHide:true suppresses the PowerShell console window
- Detection: Script-JS.Downloader.SupplyChain, Script-JS.Infostealer.SupplyChain, Text.Downloader.SupplyChain
Package Background
keythereum-utils presents itself as a utility library for Ethereum keystore operations -- the kind of helper a crypto-adjacent VS Code extension might legitimately depend on. The package was published on June 17, 2025 under the npm handle 1xlab with no declared source code repository and no prior publishing history. It accumulated 571 total downloads across six versions before npm security quarantined it with a security-holding stub.
The attack's reach comes not from the package's own popularity but from the VS Code extension it was introduced into via a malicious pull request. Any developer who updated or freshly installed that extension while the dependency was present would have executed the postinstall hook on their machine.
Attack Analysis
The infection vector is a pull request. A contributor submitted a change to a top-ranked VS Code extension repository that added as a dependency. Because the package name mimics the legitimate library -- a well-known Ethereum key-management tool -- a reviewer skimming the diff might not flag the unfamiliar version as suspicious.
%22%3E%0A%20%20%20%20%20%20%3Crect%20width%3D%2210%22%20height%3D%2220%22%20fill%3D%22%23f2930d%22%2F%3E%0A%20%20%20%20%20%20%3Crect%20x%3D%2210%22%20width%3D%2210%22%20height%3D%2220%22%20fill%3D%22%230d0d0d%22%2F%3E%0A%20%20%20%20%3C%2Fpattern%3E%0A%20%20%3C%2Fdefs%3E%0A%20%20%3Crect%20width%3D%221200%22%20height%3D%226%22%20fill%3D%22url(%23caution-stripe)%22%2F%3E%0A%3C%2Fsvg%3E){kind=small}