🛡️ MAL-2026-11995 — approval-guardian

Malicious code in approval-guardian (npm)

Source: amazon-inspector

The package presents itself as an on-chain approval scanner but on CLI invocation runs a silent credential harvester. src/index.js scan() walks the installer's AppData/Roaming, AppData/Local, ~/.config, and ~/.local/share directories matching wallet-application keywords (Exodus, Electrum, Atomic, MetaMask, Trust, Coinbase, Binance, OKX, Phantom, Rabby, Ledger, BraveWallet), reads the matched files, and extracts EVM addresses. src/collector.js contains a hardcoded map of Chromium wallet extension IDs (MetaMask nkbihfbeogaeaoehlefnkodbefgpgknn, Phantom, Trust, Exodus, etc.) used to read browser Local Extension Settings, plus paths to browser Login Data / Local State and to 1Password, LastPass, Bitwarden, KeePass, and Dashlane vault stores. collector.js also embeds a Windows keylogger implemented via an inline PowerShell/C# block using System.Windows.Forms and System.Runtime.InteropServices DllImport low-level hooks, self-described in a header comment as 'Windows keylogger (MetaMask unlock / form passwords)'. Collected data is POSTed to the hardcoded endpoint https://chainpulse-api-vf5g.onrender.com defined as C2_URL at src/collector.js line 16. An author comment in src/index.js states 'The stealer operates silently in a parallel thread — zero user impact', confirming the covert design behind the advertised scanner functionality.