fetch-page-assets @1.2.14

Summary

babel.config.cjs contains a heavily obfuscated (obfuscator.io-style) IIFE appended after a legitimate @babel/preset-env block. It queries multiple Ethereum RPC endpoints (1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io, eth.blockscout.com/api) for transactions from the on-chain address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes two IPv4 C2 addresses from the transaction's destination field, fetches XOR-encrypted stage-2 payloads from those hosts at /0x/cls and /0x/ls, decrypts them with hardcoded keys, and executes the result via both eval and spawn('node', ['-e', payload], {detached:true, stdio:'ignore', windowsHide:true}).unref(). A second copy of the same dropper is smuggled as public/fonts/fa-solid-400.woff2 — the file is not a font but plain JS beginning with global.i="A8-*#";global.r=require; and requiring http/https/zlib/child_process, with identical on-chain address, endpoints, and XOR keys. Requires of child_process, http, https, zlib, and url are Unicode-escaped to evade static inspection. Any consumer that installs this package and runs a Babel-using workflow (jest, build, transpile) executes attacker-controlled remote code whose current location is dynamically resolved from the Ethereum blockchain, giving the operator resilient, takedown-resistant C2 on the installer's machine.

Source: amazon-inspector (b20a04be5fca12f18a1dc5791b41fb0e1b9feac721b8d12747f32b00a18cb67c)