MAL-2026-15903

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f) On require of the package main, an appended eval(atob(...)) block in dist/index.js queries Ethereum RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth) for the last transaction sent from the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a and decodes the tx.to field into two IPv4 addresses. It fetches XOR-encrypted payloads from http://<resolved-ip>:443/0x/cls and http://<resolved-ip>:443/0x/ls, decrypts them with hardcoded keys, eval's the first payload in-process, and launches the second via spawn('node', ['-e', <decoded>], {detached:true, stdio:'ignore', windowsHide:true}).unref() to leave a persistent detached Node process on the host. After execution the loader rewrites dist/index.js on disk to strip the eval block, removing the payload from the file to hinder later inspection. The package impersonates @tailwindcss/container-queries by copying its README verbatim and pointing the repository field at tailwindlabs/tailwindcss-container-queries. The on-chain C2 pointer lets the operator rotate destination IPs by publishing new Ethereum transactions, so the fetched code is fully attacker-controlled.