eth-bridge @1.0.1

Summary

The package presents itself as an Ethereum bridge library but its index.js is a verbatim copy of the well-known eth-sig-util signature utility (retaining internal error strings such as "eth-sig-util.normalize() requires hex string or integer input." and attributing authorship to Dan Finlay) with an additional ~47KB obfuscated payload appended at module top level. The payload is invoked immediately via a Function("BdyPFg", "...") constructor call using a custom PRNG-driven string decoder and numeric dispatch table, meaning arbitrary attacker-controlled code executes on every require('eth-bridge') . The name/description/author mismatch combined with an opaque import-time dynamic-code-execution payload is the typosquat-with-loader shape; the legitimate eth-sig-util code serves as cover for the loader.

Source: amazon-inspector (8d7fbf15a08eb3568d462e06fa345cfdb59afe88bf38b63e47ecea29ea92c009)