@vboxdev/common @1.0.73

Summary

build/index.js appends an eval(atob('...')) block that fires when the module is required. The decoded payload queries Ethereum JSON-RPC endpoints (eth.blockscout.com, 1rpc.io/eth, eth.drpc.org, blastapi.io) for transactions from a hardcoded attacker wallet (0xa322E5f3D311D3080e6f01210639aDC2490Ef1a), reconstructs an IPv4 address from the bytes of tx.to, then fetches http://<resolved-ip>:443/0x/cls and http://<resolved-ip>:443/0x/ls. The response body is XOR-decoded with a hardcoded key and executed via eval() and a detached spawn('node','-e',...) child process (detached:true, stdio:'ignore', windowsHide:true, unref()). The C2 endpoint is mutable — the attacker rotates it by publishing new on-chain transactions from the controlled wallet — giving persistent remote code execution on any machine that imports the library. All require targets, URLs, HTTP header/method names, and error strings in the appended region are written as \u00XX unicode escapes and wrapped in base64+atob+eval; the legitimate __exportStar re-exports above the appended block are plain text, so the sole obfuscated region is the loader.

Source: amazon-inspector (d4b16f8f98ad89c1276884f96b2ef878d2c597356aa2194c7067d2d0bbda943f)