Malicious crypto-theft package targets Web3 developers in North Korean operation

Aikido Security flagged a malicious npm package, 'web3-wrapper-ethers', that impersonates the legitimate ethers library and contains obfuscated code in its wallet constructor to exfiltrate private keys to an external IP (74.119.194.244). The package author, rapid releases, added node-fetch and modified wallet source to POST private keys; later versions obfuscated the target URL but a formatting bug rendered it non-functional. The report links the infrastructure to the actor 'Void Dokkaebi' and provides the package name and IP as IOCs for detection and response.