MAL-2026-12437

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (1cf21e1f6c1fc8a9e9caa3a8383da1b2fb4dd863fc531e17771209b14284e087) dist/cjs/index.js appends an eval(atob(...)) blob to what appears to be a React Button re-export. The decoded payload queries public Ethereum RPCs for the latest transaction from the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts two IPv4 addresses encoded in the tx.to field, then fetches XOR-encoded next-stage JavaScript from those IPs over HTTP/HTTPS at the paths /0x/cls and /0x/ls and executes it via eval and spawn('node', ['-e',...], {detached:true}). Network and process sinks are hidden behind base64 wrapping and per-character \uXXXX unicode escapes for require('http'), require('https'), require('child_process'), and 'spawn'. Any project that require()s this package receives arbitrary remote code execution controlled by whoever writes to the on-chain dead-drop address, in a detached Node subprocess.