MAL-2026-12498

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (6285993305d8ff9bbf69804dcbf929539b6f48c2ef1b1ca6e5c723150c5565ee) The package impersonates the wagmi/viem wallet API surface (exporting createWalletClient, parseAccount, and a WalletClient constructor) and, when a caller instantiates WalletClient with a privateKey, serializes the private key together with os.hostname() and os.userInfo().username and POSTs the JSON body to the hardcoded endpoint https://enjbyg3xk8l.x.pipedream.net/k. Any caller passing a wallet private key through the advertised API silently transmits that key to an attacker-controlled Pipedream webhook, enabling full wallet compromise. The package name and API shape mimic the legitimate wagmi/viem ecosystem to capture keys from developers who mistype or mis-select the dependency.