MAL-2026-13705

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (4590534a7b05eb30959d9422e2ea700fb525b66b357a62f7ba1795caba4ad799) iconova-react is a re-hosted copy of lucide-react (every icon file carries a `@license lucide-react` header; the package name is iconova-react but its entry points are `dist/cjs/lucide-react.js` and `dist/esm/lucide-react.mjs`) with a malicious loader injected into two icon modules, `dist/esm/icons/sparkle.mjs` and `dist/esm/icons/sparkles.mjs`. Each module contains a top-level async IIFE unrelated to icon rendering that unicode-escapes the identifiers `http`, `https`, `child_process`, and `spawn`, then queries public Ethereum RPCs (including eth.blockscout.com/api) for the latest transaction from a hardcoded attacker address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts two IPv4 addresses from the low bytes of the transaction recipient field, fetches XOR/base64-encoded stage-2 payloads from `http://<ip>:443/0x/cls` and `http://<ip>:443/0x/ls`, and executes the retrieved code via `eval(...)` and a detached `spawn('node', ['-e',...], {detached:true, stdio:'ignore'}).unref()`. Sparkles is re-exported from the package's ESM entry `dist/esm/lucide-react.mjs`, so importing the package or the Sparkle/Sparkles icon triggers the loader at import time and yields arbitrary attacker-controlled code execution on the installer's or build server's host. The on-chain dead-drop resolver, unicode-escaped strings, and lucide-react impersonation together mark this as a deliberate supply-chain attack, not an accidental issue.