PhantomSync — 8-package npm crypto-developer cluster with delayed self-persisting dropper

What happened

Xygeni tied eight npm packages published between 2026-07-13 21:28 UTC and 2026-07-14 13:59 UTC to a single throwaway publisher — solbuilder_io, contact angel_lopez89[@]proton[.]me, with no verified GitHub identity. Every package name reads like a normal crypto-developer utility — base58-utils, abi-encode, eth-dev, arb-kit, layer2-sdk, solana-key-utils, eth-wallet-helpers, crypto-validate-lib — and each package actually contains a working implementation of the advertised primitive, which is what gets it past a casual review.

Dropper mechanics

Appended after the working utility is a self-invoking block that runs the moment the module is require()d — this is a runtime execution, not an install-time postinstall hook, so npm install --ignore-scripts and Verdaccio postinstall-blocking rules do NOT stop it. Roughly 37 seconds after import the block decodes a payload shipped inside the package as a fake test fixture, writes it to a hidden dotfile under the user's home directory, registers itself to relaunch on every login across Windows (Registry Run keys), macOS (LaunchAgents), and Linux (autostart / systemd user unit), and spawns the decoded script as a detached process. The 37-second delay is calibrated to outlast short-lived CI sandboxes that terminate before persistence is written.

Second stage — crypto-wallet & secrets stealer

The second stage waits for the host to sit idle, then walks the home directory looking for wallet material and developer secrets: Solana keypairs under ~/.config/solana, Ethereum keystore JSON under ~/.ethereum/keystore, raw Ethereum private keys, Bitcoin WIF keys, BIP-39 seed phrases, SSH private keys, and secret-bearing environment variables. Each hit is encrypted with a hardcoded RSA-4096 key and pinned to public IPFS storage — takedown of one gateway does not recover the drops. The stealer beacons back every 12 hours to check for updated instructions.

Registry timeline

• 2026-07-13 21:28 UTC — first three packages appear (solana-key-utils@1.0.0, eth-wallet-helpers@1.0.0, crypto-validate-lib@1.0.0).
• 2026-07-14 01:23–02:19 UTC — remaining five packages published; each package cycles through 2–5 rapid patch versions over ~12 hours (final tags include base58-utils@1.0.5, abi-encode@1.0.4, eth-dev@1.0.4).
• 2026-07-14 17:23 UTC — npm-support unpublishes every published version of all eight packages. Registry entries now return the packages with an empty version tree.

Related activity

Xygeni disclosed this cluster in Malicious Code Digest 79 alongside the bingo-ai PyPI velocity anomaly (~80 versions in 30 minutes) and the ongoing @wagni_bot-scope crypto-SDK impersonation wave from earlier in July. PhantomSync is a companion to the June 2026 polymarket-clob-math Vercel-loader (GHSA-3q5w-m6wr-5jp2, tracked separately) — same author profile (throwaway ProtonMail publisher, no verified source-control identity) but a different execution path (delayed post-require dropper vs. install-time Vercel fetcher).

Affected packages (8)

Impact

• Import-time (not install-time) execution — the dropper hides behind a working utility so npm install --ignore-scripts does not stop it; the payload fires the first time app code require/imports any of the 8 packages
• ~37-second delay before staging — designed to slip past sandbox / short-lived CI runners that terminate before the payload is written to disk
• Cross-platform persistence installed on Windows, macOS, and Linux — the decoded script registers a login-time restart, so a single import compromises the developer laptop until the persistence hooks are removed
• Crypto-wallet key theft — Solana keypairs (~/.config/solana), Ethereum keystores (~/.ethereum/keystore), Bitcoin WIF keys, and BIP-39 seed phrases are walked out of the home directory
• Broader credential theft — SSH private keys and any secret-bearing environment variables are collected in the same sweep
• Findings are RSA-4096-encrypted and pinned to public IPFS storage — takedown of any single gateway does not stop retrieval; the operator beacons back every 12 hours to fetch new drops

What to do

1. 1Grep package.json, lockfiles, CI image layers, and internal Verdaccio/Nexus/Artifactory caches for any of the 8 package names; delete every reference — npm-support has already unpublished them so npm install will hard-fail otherwise
2. 2On any developer laptop or CI runner that imported one of these packages, treat as fully compromised: rotate crypto-wallet seed phrases and private keys, SSH keys, cloud CLI tokens, and any secret-bearing environment variables from a separate clean device
3. 3Audit persistence: check login items on macOS (~/Library/LaunchAgents), Registry Run keys and Startup folder on Windows, and ~/.config/autostart + systemd user units on Linux for entries created since 2026-07-13
4. 4Grep host telemetry for outbound HTTPS to public IPFS gateways (ipfs.io, cf-ipfs.com, dweb.link, gateway.pinata.cloud) originating from Node processes or persisted background scripts since 2026-07-13
5. 5For Solana / Ethereum project teams: enforce scoped-name policies (@solana/*, @ethereum-attestation/*) in linting so unscoped lookalikes like solana-key-utils cannot autocomplete-blind into a lockfile

References

• PhantomSync: eight crypto-developer npm packages hide a delayed, self-persisting dropper

  xygeni.io
  Xygeni
• Xygeni Malicious Code Digest 79 — July 10–17 npm/PyPI recap

  xygeni.io
  Xygeni
• base58-utils on the npm registry (all versions unpublished)

  registry.npmjs.org
  npm
• eth-wallet-helpers on the npm registry (all versions unpublished)

  registry.npmjs.org
  npm