The sky isn't falling, but #opensource is falling victim to supply chain attacks. When such an attack happens, this built-in functionality can be abused & it is important to be able to detect it. Our intention is to raise awareness about what can happen so the community can defend against it.

This method is then being called from procedures that are responsible for generating wallet keys, essentially exfiltrating the sensitive wallet data to the threat actor.

It contains a malicious method "Shuffle" that sends data to a remote URL, which is encrypted in the code, to avoid detection.