zenntechinc-cli @1.6.6

Summary

The npm package ships an obfuscated payload appended to templates/backend/.eslintrc.js, after a legitimate-looking ESLint config. The payload uses obfuscator.io-style string-array indirection (rotating _0x12f0() table, hex-named identifiers) to conceal Ethereum JSON-RPC endpoints (eth.drpc.org, ethereum.publicnode.com, blastapi.io, blockscout) and an Etherscan-style txlist indexer path. It queries the latest transaction from a hardcoded sender address (0xa322e5f3...9adc2490ef), decodes two IPv4 C2 addresses from the transaction's to field, fetches an XOR-encoded payload from those IPs, and executes it via eval() and spawn('node', ['-e', payload], {detached:true}).unref(). The CLI's new subcommand in bin/zenntechinc.js recursively copies the entire templates/backend tree — including the malicious.eslintrc.js — into the user-specified target directory via copyDirectory(), with no filtering. Any subsequent editor open, ESLint invocation, or lint script run inside the generated project loads this.eslintrc.js and triggers the blockchain-resolved remote code execution with full developer privileges. The CLI's advertised purpose (backend scaffolding) is the delivery vector for the RCE payload into the installer's workspace.

Source: amazon-inspector (1ab82f90e45185d5e25435ce8fc92501dbf7b7384ec6eea6e6b7416ac9426cfb)