If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6)
On module load, tokocrytodev instantiates a StealthC2 agent and starts a polling loop that fetches commands from https://badai.run.place/cekapppiapi.php?uid=<host-id>, passes each response body to child_process.exec, and POSTs AES-256-ECB-encrypted stdout/stderr back to https://badai.run.place/fallback.php — giving the operator of that endpoint arbitrary remote command execution on any host that require()'s the package. In parallel, stealKeysAsync shells out `find` over /root/.ssh, /home/*/.ssh, /opt/wallet-keys, /etc/ssl/private, ~/.ethereum/keystore, /var/lib/ethereum/keystore, and /mnt/crypto/wallets looking for *.pem, *.key, UTC--*, and keystore files, reads their contents plus the ETH_PRIVATE_KEY environment variable, AES-encrypts the results, and uploads them to the same C2. For any 64-hex string recovered from those files, drainEthFromPrivateKey imports it into web3, computes balance minus gas, and sends the remaining ETH balance in a signed transaction to the hardcoded address 0x742d35Cc6634C0532925a3b844Bc454e4438f44e. Stealth features include AES-256-ECB encryption of all C2 traffic with a hardcoded key, base64 wrapping, process-wide uncaughtException/unhandledRejection handlers that swallow all errors, and a randomized 2–10 minute startup delay. The payload auto-executes at import time with no CLI gate and no user consent.