// npm package
@parity/product-sdk-signer
Signer manager for Polkadot — Host API and dev accounts
versions
10
maintainers
12
license
Apache-2.0
first publish
2026-04-23
publisher
paritytech-ci
tarball
355,709 B
AUTO-PUBLISHED·1 version indexed·latest published 2026-06-03
// exfil path
what is read → where it shipssteals
- ● Seed phrase
sends to
(no destination string extracted — payload may be dynamic / obfuscated)
→ view full payload// publisher campaignby paritytech-ci
2 caught packages from this accountThis is not an isolated catch. The same publisher has shipped 1 other package that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.
// offending code· @0.6.0· 1 file flagged
- @0.6.0··AUTO-PUBLISHED·publisher: paritytech-ciheuristic 64/100static flags 1llm skippednew-publisher:21dmature-packagepublisher-multi-name-burst:9publisher-version-pump:10reads-seed-phrase
// offending code· 1 file flaggedpatterns: 1
--- package/src/providers/dev.ts (excerpt) --- // Copyright 2026 Parity Technologies (UK) Ltd. // SPDX-License-Identifier: Apache-2.0 import { seedToAccount } from "@parity/product-sdk-keys"; import { createLogger } from "@parity/product-sdk-logger"; import type { SignerError } from "../errors.js"; import type { Result, SignerAccount } from "../types.js"; import { ok } from "../types.js"; import type { SignerProvider, Unsubscribe } from "./types.js"; const log = createLogger("signer:dev"); /** The well-known Substrate development mnemonic phrase. */ const DEV_PHRASE = "bottom drive obey lake curtain smoke basket hold race lonely fit walk"; /** Standard Substrate dev account names. */ const DEFAULT_DEV_NAMES = ["Alice", "Bob", "Charlie", "Dave", "Eve", "Ferdie"] as const; /** A well-known Substrate development account name (Alice, Bob, …) used to derive deterministic dev accounts from the standard Substrate dev mnemonic. */ export type DevAccountName = (typeof DEFAULT_DEV_NAMES)[number]; /** Supported key types for dev account derivation. */ export type DevKeyType = "sr25519" | "ed25519"; /** Options for the dev account provider. */ export interface DevProviderOptions { /** Which dev accounts to create. Default: all 6 standard accounts. */ names?: readonly string[]; /** Custom mnemonic phrase instead of DEV_PHRASE. */ mnemonic?: string; /** SS58 prefix for address encoding. Default: 42 */ ss58Prefix?: number; /** Key type for account derivation. Default: "sr25519" */ keyType?: DevKeyT
