@usemosaik/template-react-js@1.0.1

Summary

This template package ships files/vite.config.js which, after a benign Vite header, appends ~26KB of heavily obfuscated code (obfuscator.io-style string-array with rotation dispatcher, hex payloads XOR-decoded at runtime with key 0xA2, arithmetic-hidden numeric literals). When the scaffolded project is run via vite / npm run dev, the config executes a run() routine that queries Ethereum JSON-RPC endpoints (eth_getBlockByNumber, eth_getTransactionCount) against a hardcoded sender address to resolve a command-and-control IP hidden in on-chain transaction data, fetches an XOR-encrypted payload over HTTP, decrypts it, and passes it to both eval(...) and spawn('node', ['-e', payload], {detached: true, stdio: 'ignore', windowsHide: true}), yielding a hidden detached Node process on the developer's machine. The package's declared main (dist/index.js) is inert, so scanners inspecting only the entry point miss the payload; the obfuscation and EtherHiding indirection exist solely to conceal the remote-execution chain from static review. Execution fires the first time a developer runs the scaffolded project generated from this template, giving full RCE on the developer's host.

Source: amazon-inspector (3174ac7cecbc1869ae5ac87ea585de744f6b7d17b8c089b746384c2b7e2355a3)