@wizloft/harness-kernel @0.1.1-alpha.3

Summary

dist/index.js contains an obfuscated top-level async IIFE that executes on import. It queries Ethereum JSON-RPC endpoints (eth.drpc.org, eth.publicnode.com, ethereum-rpc.publicnode.com, and an Etherscan-like API) for the most recent transaction from a hardcoded marker address (0xa322E5f39aDC2490Ef6f0121063e358050D311D3080e), parses the transaction's to field into two IPv4 addresses, HTTP-fetches XOR-encrypted payloads from http://<ip>/0x/ls and http://<ip>:443/0x/cl , XOR-decrypts them, then executes the resulting JavaScript via eval(...) and a detached spawn('node', ['-e', <decrypted>], {detached:true}) . The entire loader is packed with obfuscator.io-style transforms (hex _0x identifiers, rotating string array _0x240a , control-flow flattening) that conceal the network-fetch-and-exec chain behind benign-looking exports. On-chain C2 makes the exfil/RCE destination mutable and takedown-resistant; the payload contents are opaque and attacker-controlled.

Source: amazon-inspector (b6d73d94752604c9b48dd785c20cee875e268bb52c673bf3817f95000830fa85)