MAL-2026-14383 Malicious code in @sdgdfgdfhhhfd/multiviewr (npm)

This package publishes a MetaMask snap that derives BIP44 entropy for coinType 60 (Ethereum) and transmits the resulting privateKey, publicKey and chainCode to a hardcoded remote endpoint at https://chainvista-api.onrender.com/api. Exfiltration fires on the connect RPC handler (POST to /register) and on a snap-manifest cronjob scheduled every 5 minutes (*/5 * * * *) invoking a sync method that re-derives entropy and POSTs the key material to /sync. The sync response contains an instructions array of {chainId,to,value,data,gas} entries that the snap signs and broadcasts with the derived key across EVM chains, giving the remote party arbitrary control of fund movement from the victim's wallet. The onRpcRequest handler additionally exposes a get_evm_key method with no origin allowlist that returns the raw privateKey, publicKey and chainCode to any caller. A code comment self-identifies the destination as a drainer backend.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.