
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
mpw is a little software which stores your passwords in GnuPG encrypted files.
On debian or ubuntu:
apt install ruby ruby-dev xclip
gem install mpw
Initialize your first wallet:
mpw config --init user@host.com
Add your first item:
mpw add --host assurance.com --port 443 --user user_2132 --protocol https --random
mpw add --host fric.com --user 230403 --otp-code 23434113 --protocol https --comment 'I love my bank' --random
And list your items:
mpw list
or search an item with
mpw list --pattern love
mpw list --group bank
Output:
Assurance
==========================================================================
ID | Host | User | OTP | Comment
==========================================================================
1 | https://assurance.com:443 | user_2132 | |
Bank
==========================================================================
ID | Host | User | OTP | Comment
==========================================================================
3 | https://fric.com | 230403 | X | I love my bank
Copy a password, login or OTP code:
mpw copy -p assurance.com
Update an item:
mpw update -p assurance.com
Delete an item:
mpw delete -p assurance.com
List all available wallets:
mpw wallet
List all GPG keys in wallet:
mpw wallet --list-keys [--wallet NAME]
Share with an other GPG key:
mpw wallet --add-gpg-key test42@localhost.com
or
mpw wallet --add-gpg-key /path/to/file
Remove a GPG key:
mpw wallet --delete-gpg-key test42@localhost.com
You can export your data in yaml file with your passwords in clear text:
mpw export --file export.yml
Import data from an yaml file:
mpw import --file import.yml
Example yaml file for mpw:
---
1:
host: fric.com
user: 230403
group: Bank
password: 5XdiTQOubRDw9B0aJoMlcEyL
protocol: https
port:
otp_key: 330223432
comment: I love my bank
2:
host: assurance.com
user: user_2132
group: Assurance
password: DMyK6B3v4bWO52VzU7aTHIem
protocol: https
port: 443
otp_key:
comment:
Print the current config
mpw config
Output:
Configuration
==============================================
lang | fr
gpg_key | mpw@yae.im
default_wallet |
config_dir | /home/mpw/.config/mpw
pinmode | true
gpg_exe |
path_wallet_test | /tmp/test.mpw
password_numeric | true
password_alpha | true
password_special | false
password_length | 16
FAQs
Unknown package
We found that mpw demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.