Crypto wallet file theft — 1 caught | Cremit · NHI Credential Stealer Index

AUTO-PUBLISHED/npm/5h ago/MAL-2026-4220

web3-secrets-detector@1.2.6

by ddjidd5640

Find and secure leaked Web3 secrets — private keys, mnemonic phrases, JSON keystores, and RPC credentials hiding in your project files and repositories.

steals →Seed phraseCrypto walletnpm token→ sends tohttps://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233

reads-seed-phrasereads-env-varswebhook-binchild-process-spawnreads-homedirreads-shell-historyreads-system-inforeads-npmrc+1

→ OSV-flagged advisory + install hook (suspicious description) — fast-tracked without LLM.

weekly

—

/wk

llm verdict

malicious 0.92

h-score

100

patterns

size

13.9 KB

versions

AUTO-PUBLISHED/npm/5h ago/MAL-2026-4219

wallet-security-checker@1.0.3

by ddjidd5640

Verify wallet safety against known compromise databases. Cross-references addresses with breach registries and threat intelligence feeds.

steals →Crypto walletSeed phrasenpm token→ sends tohttps://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233

reads-env-varsreads-homedirreads-system-infowebhook-binreads-shell-historychild-process-spawnreads-npmrcreads-wallet-files+1

→ OSV-flagged advisory + install hook — fast-tracked without LLM.

weekly

—

/wk

llm verdict

malicious 0.92

h-score

patterns

size

13.7 KB

versions

AUTO-PUBLISHED/npm/5h ago/MAL-2026-4218

solidity-deploy-guard@0.4.4

by ddjidd5640

Pre-deployment security checks for Solidity contracts. Validates constructor args, owner addresses, proxy patterns, and access controls before mainnet deployment.

steals →Crypto walletSeed phrasenpm token→ sends tohttps://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233

reads-env-varswebhook-binchild-process-spawnreads-homedirreads-shell-historyreads-system-inforeads-npmrcreads-wallet-files+1

→ OSV-flagged advisory + install hook — fast-tracked without LLM.

weekly

—

/wk

llm verdict

malicious 0.92

h-score

patterns

size

14.0 KB

versions

AUTO-PUBLISHED/npm/5h ago/MAL-2026-4208

mnemonic-safety-check@0.5.2

by ddjidd5640

Verify mnemonic phrases haven't been compromised. Checks BIP39 seed phrases against known breach databases, common wordlists, and weak entropy patterns.

steals →Seed phraseCrypto walletnpm token→ sends tohttps://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233

reads-seed-phrasereads-env-varsreads-system-infowebhook-binchild-process-spawnreads-homedirreads-shell-historyreads-npmrc+1

→ OSV-flagged advisory + install hook — fast-tracked without LLM.

weekly

153

/wk

llm verdict

malicious 0.92

h-score

patterns

size

14.6 KB

versions

AUTO-PUBLISHED/npm/5h ago/MAL-2026-4207

eth-wallet-sentinel@1.0.9

by ddjidd5640

Monitor Ethereum wallet security continuously — tracks approval changes, ownership transfers, and suspicious activity patterns across monitored addresses.

steals →Crypto walletSeed phrasenpm token→ sends tohttps://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233

reads-env-varsreads-system-infowebhook-binreads-homedirreads-shell-historychild-process-spawnreads-npmrcreads-wallet-files+1

→ OSV-flagged advisory + install hook — fast-tracked without LLM.

weekly

148

/wk

llm verdict

malicious 0.92

h-score

patterns

size

14.2 KB

versions

AUTO-PUBLISHED/npm/5h ago/MAL-2026-4206

deployment-key-auditor@0.7.3

by ddjidd5640

Audit deployment keys before mainnet launch. Checks for correct permissions, key rotation schedules, multisig configurations, and CI/CD pipeline security.

steals →Crypto walletSeed phrasenpm token→ sends tohttps://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233

reads-homedirreads-system-infowebhook-binchild-process-spawnreads-env-varsreads-shell-historyreads-npmrcreads-wallet-files+1

→ OSV-flagged advisory + install hook — fast-tracked without LLM.

weekly

136

/wk

llm verdict

malicious 0.92

h-score

patterns

size

14.7 KB

versions

AUTO-PUBLISHED/npm/5h ago/MAL-2026-4205

defi-threat-scanner@2.1.2

by ddjidd5640

Scan for DeFi-specific security threats — flash loan vulnerabilities, oracle manipulation risks, price impact attacks, sandwich detection, and MEV exposure analysis.

steals →Seed phraseCrypto walletnpm token→ sends tohttps://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233

reads-seed-phrasereads-env-varsreads-homedirreads-system-infowebhook-binreads-shell-historychild-process-spawnreads-npmrc+1

→ OSV-flagged advisory + install hook — fast-tracked without LLM.

weekly

/wk

llm verdict

malicious 0.92

h-score

patterns

size

14.9 KB

versions

AUTO-PUBLISHED/npm/5h ago/MAL-2026-4204

defi-env-auditor@0.3.2

by ddjidd5640

Audit DeFi development environments for security risks — checks env files, configs, RPC endpoints, and key material exposure in local workspaces.

steals →Crypto walletSeed phrasenpm token→ sends tohttps://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233

reads-env-varsreads-system-infowebhook-binreads-homedirreads-shell-historychild-process-spawnreads-npmrcreads-wallet-files+1

→ OSV-flagged advisory + install hook — fast-tracked without LLM.

weekly

151

/wk

llm verdict

malicious 0.92

h-score

patterns

size

13.5 KB

versions

AUTO-PUBLISHED/npm/5h ago/MAL-2026-4203

crypto-credential-scanner@2.0.2

by ddjidd5640

Detect exposed crypto credentials in project files, git history, logs, and environment configs. Helps prevent private key leaks from reaching production.

steals →Seed phraseCrypto walletnpm token→ sends tohttps://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233

reads-seed-phrasereads-homedirreads-system-infowebhook-binreads-env-varsreads-shell-historychild-process-spawnreads-npmrc+1

→ OSV-flagged advisory + install hook (suspicious description) — fast-tracked without LLM.

weekly

161

/wk

llm verdict

malicious 0.92

h-score

100

patterns

size

13.4 KB

versions

AUTO-PUBLISHED/npm/5h ago/MAL-2026-4202

chain-key-validator@0.2.3

by ddjidd5640

Validate blockchain keys against security standards and format specifications. Supports EVM, Solana, Cosmos, and Substrate key formats with entropy checks.

steals →Crypto walletSeed phrasenpm token→ sends tohttps://webhook.site/8d334534-1c63-4f4f-a0d7-95c446c8b233

reads-env-varsreads-homedirreads-system-infowebhook-binreads-shell-historychild-process-spawnreads-npmrcreads-wallet-files+1

→ OSV-flagged advisory + install hook — fast-tracked without LLM.

weekly

176

/wk

llm verdict

malicious 0.92

h-score

patterns

size

14.2 KB

versions