@syncraft-labs/react @0.4.1

Summary

dist/index.js (the ESM entry resolved by default by modern bundlers such as Vite, Next.js, and Webpack) contains a heavily obfuscated block using obfuscator.io-style identifiers, a rotated ~300-entry string array, and a decoder wrapper injected inside the useEffect body of the useSync hook. The block captures globalThis.r=require and globalThis.m=module, then uses http/https and zlib (createInflate/createBrotli) to fetch data from Ethereum RPC endpoints (h.drpc.org, 1rpc.io/eth), Blockscout, and Etherscan for a hardcoded contract address (0xa322E5f3...), reconstructs code from the on-chain bytes, and executes it with require access. This is the EtherHiding pattern: the on-chain contract is mutable, so operators of that contract can deliver arbitrary JavaScript to any consumer that renders a component using useSync, achieving remote code execution in Node build/SSR contexts and in the browser bundle of downstream applications. The obfuscated blob is absent from dist/index.cjs and from the TypeScript sources referenced by dist/index.js.map, indicating the ESM artifact was tampered after build.

Source: amazon-inspector (c3986bd05347035d9263c22b871840f19dc42187d3e1719311cb67c6e1ef5cb9)