@syncraft-labs/core @0.4.1

Summary

The ESM build shipped at dist/index.js contains a heavily obfuscated payload (hex-identifier string-array + rotator produced by an obfuscator.io-style tool) injected into the body of isDevMode(), which executes on every import / require of the package. The injected loader captures Node internals onto globalThis (globalThis.r = require, globalThis.m = module, globalThis.i = "A12-synd"), then uses http/https to query Ethereum JSON-RPC endpoints (eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blockscout.com) and an Etherscan-style txlist API for a hardcoded attacker address (0xa322E5f3...), decodes and zlib-decompresses payload bytes from transaction data, and executes them via child_process.spawn. The CJS build of the same source is clean, indicating a targeted injection into the ESM entry rather than a bundler artifact. Any process importing this package fetches attacker-controlled code from a mutable on-chain dead-drop and runs it, giving the publisher arbitrary remote code execution on the installer's host with full Node capability handed to the second stage via the globalThis handoff.

Source: amazon-inspector (0efe219063a966d0d2025d6c3274cbc7e9f3c0b3a1e9cdf81c7adf6dbae4d4ac)