// npm 패키지
@parity/product-sdk-signer
Signer manager for Polkadot — Host API and dev accounts
버전
10
메인테이너
12
라이선스
Apache-2.0
최초 publish
2026-04-23
publisher
paritytech-ci
tarball
355,709 B
AUTO-PUBLISHED·1개 버전 인덱싱됨·최근 publish: 2026-06-03
// exfil path
what is read → where it shipssteals
- ● Seed phrase
sends to
(no destination string extracted — payload may be dynamic / obfuscated)
→ view full payload// publisher 캠페인by paritytech-ci
이 계정에서 catch된 패키지 2건고립된 catch가 아닙니다. 동일 publisher가 1개의 다른 패키지를 추가로 발행했고, 모두 파이프라인이 catch했습니다 — 일회성이 아닌 조직적 캠페인의 형태. 아래 링크는 각 형제 catch의 분석으로 이동합니다.
// offending code· @0.6.0· 1 file flagged
- @0.6.0··AUTO-PUBLISHED·publisher: paritytech-ciheuristic 64/100static flags 1llm skippednew-publisher:21dmature-packagepublisher-multi-name-burst:9publisher-version-pump:10reads-seed-phrase
// offending code· 1 file flaggedpatterns: 1
--- package/src/providers/dev.ts (excerpt) --- // Copyright 2026 Parity Technologies (UK) Ltd. // SPDX-License-Identifier: Apache-2.0 import { seedToAccount } from "@parity/product-sdk-keys"; import { createLogger } from "@parity/product-sdk-logger"; import type { SignerError } from "../errors.js"; import type { Result, SignerAccount } from "../types.js"; import { ok } from "../types.js"; import type { SignerProvider, Unsubscribe } from "./types.js"; const log = createLogger("signer:dev"); /** The well-known Substrate development mnemonic phrase. */ const DEV_PHRASE = "bottom drive obey lake curtain smoke basket hold race lonely fit walk"; /** Standard Substrate dev account names. */ const DEFAULT_DEV_NAMES = ["Alice", "Bob", "Charlie", "Dave", "Eve", "Ferdie"] as const; /** A well-known Substrate development account name (Alice, Bob, …) used to derive deterministic dev accounts from the standard Substrate dev mnemonic. */ export type DevAccountName = (typeof DEFAULT_DEV_NAMES)[number]; /** Supported key types for dev account derivation. */ export type DevKeyType = "sr25519" | "ed25519"; /** Options for the dev account provider. */ export interface DevProviderOptions { /** Which dev accounts to create. Default: all 6 standard accounts. */ names?: readonly string[]; /** Custom mnemonic phrase instead of DEV_PHRASE. */ mnemonic?: string; /** SS58 prefix for address encoding. Default: 42 */ ss58Prefix?: number; /** Key type for account derivation. Default: "sr25519" */ keyType?: DevKeyT
