MSC-2026-11392

Malicious cryptocurrency wallet-drainer disguised as a JavaScript object-utility. index.js auto-executes on require/import, reads the host .env for PRIVATEKEY/SECRET/MNEMONIC, and attempts to send funds to hardcoded attacker wallets via ethers.Wallet.sendTransaction. As shipped the build is...

MSC-2026-11394

Malicious cryptocurrency wallet-drainer disguised as a JavaScript utility. index.js auto-executes on require/import, reads the host .env for PRIVATEKEY/SECRET/MNEMONIC values, and attempts to transfer funds to hardcoded attacker-controlled wallets across 26 chains via ethers.Wallet.sendTransactio...