godot-kit@1.0.1786316795

Summary

lang/gdscript.js appends a hostile IIFE after module.exports that runs when the module is require()'d (reachable via lang/loader.js and test.js). The payload queries public Ethereum RPCs and eth.blockscout.com for the latest transaction from hardcoded wallet 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, interprets the destination-address bytes as two IPv4 addresses (a blockchain dead-drop C2 resolver rotated by the attacker publishing new transactions), HTTP-GETs XOR-encoded JavaScript from those IPs, and executes it via eval() and a detached spawn('node', ['-e',...]) process. Identifiers, module names (http, https, zlib, child_process), the Blockscout URL, the wallet address, and header names are hidden behind \u00XX unicode escapes. Additional patterns in the same file include child_process + http.request + POST/GET flows and os.tmpdir() staging. The package also contacts https://eth-mainnet.public.blastapi.io as one of the ETH RPC providers used for C2 resolution.

Source: amazon-inspector (edb0e7385ab0574f7223206d79822362c142c664b0aed0ae5a00546b6bb38ef4)