MAL-WALLET Crypto-Wallet Drainer and Clipboard Clipper
Two adjacent supply-chain payload shapes that target crypto users from inside a repository the author controls: reading wallet key material and sending it off the machine, and watching the clipboard so a copied wallet address can be swapped for the attacker's own.
What Vulkro detects
MAL-WALLET-001 (drainer) fires when source that reads a wallet key or seed (Keypair.fromSecretKey, a privateKey / secretKey / mnemonic / seedPhrase reference, a browser wallet-extension store path, or the window.ethereum provider) sits within a small window of source lines of a network egress call. A genuine secret-key or seed export grades High confidence; a bare window.ethereum provider read, which cannot itself export a private key, grades Medium.
MAL-WALLET-002 (clipper) fires when source that reads the clipboard (clipboardy, navigator.clipboard.readText, pbpaste, xclip, xsel) sits near a hardcoded crypto-address literal (a BTC 1 / 3 / bc1 address, or an 0x-prefixed 40-hex ETH address). A legitimate copy-to-clipboard button only writes a runtime variable and does not match.
What this does not claim: proximity, not dataflow. It shows both capabilities are present and adjacent, not that the bytes flow from one to the other. A lone half must not fire, because a dapp legitimately reads window.ethereum. It walks JS/TS and Python files and never certifies code safe.
Remediation. Do not run the repository on a machine holding wallet keys. If it has already run, move funds to a wallet whose seed that machine never saw, and verify the destination address at signing time rather than trusting the clipboard.
See also
- Confidence model - what
High,Medium, andLowmean for findings in this category. - Privacy - what Vulkro does and does not access on your machine.
References
This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.