Comment by sunshine-o

I was looking at the packages affected and there are some recognizable names.

The ones that got my attentions are the @ensdomains/*, that are the legit packages and are probably in every Ethereum/EVM/blockchain related apps for the resolution of decentralized domain names.

A quick search shows those Ledger hardware wallet use those libs too [0]

So I guess they weren't just after API keys.

- [0] https://github.com/search?q=org%3ALedgerHQ%20%40ensdomain&ty...