@hoteldev/common @1.0.9

Summary

build/index.js appends an eval(atob(...)) block after the normal __exportStar section that decodes to an import-time loader. The loader resolves a C2 IP by reading an Ethereum transaction associated with wallet 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a (via eth_getBlockByNumber), then issues HTTP requests to http://<derived-IP>:443/0x/cls and http://<derived-IP>:443/0x/ls with an x-payload-b64 header, XOR-decrypts the responses, and launches each decoded body through spawn('node', ['-e', <payload>], {detached: true, stdio: 'ignore', windowsHide: true}).unref(). Strings inside the payload (http, https, spawn, child_process, eth_getBlockByNumber, x-payload-b64) are written as \u#### unicode escapes to hide the behavior from casual review. The loader runs on any require/import of the package, giving the operator of the on-chain-designated host arbitrary, hidden, detached code execution on the installer's machine, with the C2 address rotatable via a new Ethereum transaction.

Source: amazon-inspector (9bb27849cbb16840b019ef47d6a84627d61eb9d48df28da5a9bc1a208e1ff758)