MAL-2026-15904

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (2c9c5760f878552d4d2aedb3afc283b64ba99e65acf1e086158afe79a0267ada) dist/index.js exports a small tailwind plugin and then runs eval(atob("Z2x...")) on an embedded base64 blob at module load time. The decoded loader queries Ethereum RPC endpoints (1rpc.io/eth, drpc.org, publicnode, blastapi.io) and Blockscout for the most recent transaction sent by hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes four bytes of that transaction's `to` field into an IPv4 address, HTTP-GETs http://<decoded-ip>:443/0x/cls and http://<decoded-ip>:443/0x/ls, XOR-decodes the response with literal keys, and executes it via eval() and via a detached `spawn("node", ["-e",...], {detached:true, stdio:"ignore", windowsHide:true}).unref()`. After first execution the loader reads its own file, locates the `eval(atob("Z2x...` region, and rewrites dist/index.js with the region removed, so the malicious line disappears from disk. The Ethereum-transaction-based resolver lets the operator rotate the C2 IP at any time by publishing a new transaction from the controlling address, and the self-erasing stub defeats post-incident inspection of the installed copy.