@rentwise/common @1.0.36

Summary

build/index.js appends an eval(atob(...)) blob to the legitimate common-library exports, so the payload runs whenever any consumer require()s @rentwise/common. The decoded payload queries public Ethereum JSON-RPC nodes and eth.blockscout.com/api to fetch the latest transaction sent by the hardcoded wallet 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, reconstructs an IPv4 address from the transaction's tx.to field (bytes 0-3 as octets), then HTTP GETs http://<ip>:443/0x/cls and http://<ip>:443/0x/ls. The response body is XOR-decoded using the x-payload-b64 header, eval()'d in-process, and additionally spawned as a detached node -e <payload> child process with stdio:ignore and windowsHide. All strings (module names http/https/zlib/child_process, URLs, RPC method names) are \uXXXX-escaped inside the base64 blob to defeat static string matching. The blockchain-anchored C2 (EtherHiding pattern) lets the operator rotate infrastructure by broadcasting a new on-chain transaction. This grants arbitrary remote code execution on any host that installs and loads the package.

Source: amazon-inspector (7e2ac6bf5ebc05e3dcf6a84122d0b10d5d5f36c5b4cec9f8d0b305d1b8125f47)