// publisher campaign · npm

ddjidd5640

All caught packages published by the ddjidd5640 account on npm, plus the author + maintainer info the registry currently exposes. Use this view to pivot: shared emails / names across packages are strong evidence of a single attacker behind multiple throwaway handles.

npmjs.com publisher

packages

distinct names

catch events

169

versions × names

blast

588/wk

combined weekly downloads

active span

2026-05-19 → 2026-05-21

first → last catch

// publisher osint

Account-level signals. Activity span tells you how long this handle has been around (fresh = throwaway-prone). Email domains separate single-use webmail from real org addresses. Cross-ecosystem handles + GitHub links are the strongest attribution pivot — same name on multiple registries usually means same operator.

activity on npm

Not available on this ecosystem (registry search unsupported).

same handle on other registries

npm /~ddjidd5640: not found
pypi /user/ddjidd5640: exists ↗
github.com/ddjidd5640: not found

// exfil path

what is read → where it ships

steals

● Seed phrase
● npm token
● Crypto wallet
● AWS keys
○ home dir
○ shell history
○ system info

sends to

⇢ https://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233(webhook.site)
⇢ https://webhook.site/f684d33e-7d78-49cb-8798-49952a0a3036(webhook.site)
⚙ dns tunneling(fetches + executes remote payload)

// shared exfil infrastructure

Webhook URLs and public IPs referenced by more than one package in this campaign — the smoking-gun signal for shared backend infrastructure.

shared webhook URLs (1)

https://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233(10 pkgs: web3-secrets-detector, chain-key-validator, crypto-credential-scanner, wallet-security-checker, solidity-deploy-guard, defi-threat-scanner, mnemonic-safety-check, deployment-key-auditor, eth-wallet-sentinel, defi-env-auditor)

+ 1 unique webhook URL (one package each)

https://webhook.site/f684d33e-7d78-49cb-8798-49952a0a3036(env-security-scanner)

// pattern footprint

Static-analysis flags that fired across the campaign, with how many packages each touched. Use as the "what kind of stealer is this" answer.

×11
×11
×11
×11
×11
×10
×10
×10
×10
×10
×1
×1

// packages in this campaign

11 distinct · newest first

ddjidd5640

// publisher osint

// exfil path

// shared exfil infrastructure

// pattern footprint

// packages in this campaign

web3-secrets-detector18 versions·1.2.4→4.0.0

chain-key-validator17 versions·0.2.3→4.0.0

crypto-credential-scanner16 versions·2.0.2→4.0.0

wallet-security-checker16 versions·1.0.3→4.0.0

solidity-deploy-guard16 versions·0.4.4→4.0.0

defi-threat-scanner17 versions·2.1.0→4.0.0

mnemonic-safety-check17 versions·0.5.2→4.0.0

deployment-key-auditor17 versions·0.7.3→4.0.0

eth-wallet-sentinel17 versions·1.0.9→4.0.0

defi-env-auditor17 versions·0.3.2→4.0.0

env-security-scanner@1.6.0