@rentwise/common@1.0.36

Analysis

@rentwise/common@1.0.36 ships a hidden C2 implant appended to build/index.js. On load, the package decodes an obfuscated payload that queries public Ethereum JSON-RPC endpoints (1rpc[.]io/eth, eth[.]drpc[.]org, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io) to read a transaction from a hardcoded address, derives two IPv4 addresses from the transaction's `to` field, and then spawns detached `node -e` processes that beacon to hxxp://<derived-ip>:443/0x/cls and /0x/ls, sending XOR-encoded payloads in an x-payload-b64 header. The implant establishes outbound connections to the derived C2 hosts over HTTP.