MSC-2026-11392

Malicious cryptocurrency wallet-drainer disguised as a JavaScript object-utility. index.js auto-executes on require/import, reads the host .env for PRIVATEKEY/SECRET/MNEMONIC, and attempts to send funds to hardcoded attacker wallets via ethers.Wallet.sendTransaction. As shipped the build is...