webdev-conf@5.0.0

Analysis

webdev-conf@5.0.0 is a trojanized clone of a legitimate config-reading package. index.js contains the real packageConfig code as camouflage with a large base64-encoded payload appended that executes on require. The payload is an Ethereum JSON-RPC client that reads the latest block and watches for a transaction from address 0x0xa3322e5f3d311d30e6f0102106f31065, extracts the transaction's destination address, and splits it into two IPv4 addresses used as the command-and-control host. It then spawns a detached node process that connects to hxxp://<ip>:443/0x/cls and hxxp://<ip>:443/0x/ls, fetching XOR-encoded second-stage payloads (x-payload-base64 header) and executing them. The C2 endpoint is derived from the blockchain at runtime, so it is not visible in the package source. The payload also sets global variables _V, _H, _H2, _t_s, _t_u pointing at the derived host on ports 80 and 443.