@wizloft/harness-context @0.1.1-alpha.3

Summary

dist/index.js (the package's declared main) contains a heavily obfuscated obfuscator.io-style IIFE appended after the legitimate context-service code. On import, the payload stashes global.r = require and global.m = module , then issues HTTPS requests to an Ethereum public RPC endpoint (h.drpc.org) and a block-explorer account API to read state from contract 0xa322E5f3..., using that state to resolve a next-stage URL that is fetched and executed in-process. The obfuscated string array (~303 entries via a rotated decoder) hides drpc.org , ?module=ac , POST , application/json , Mozilla/5. , and the contract address. This is the EtherHiding loader pattern: attacker-controlled contract state serves as a mutable pointer to arbitrary code executed in the installer/consumer process at require time. Behavior does not match the package's advertised purpose of a small typed capability contract.

Source: amazon-inspector (b0315deb3fb6b42e929a55eafaeaedbf1b428ee8873d4ae31f5ec9956f21b554)