@nasdtickets/common@1.0.23

Analysis

@nasdtickets/common@1.0.23 ships a malicious payload appended to build/index.js inside an otherwise-legitimate TypeScript library. On load it runs an eval(atob(...)) decoder that implements a blockchain-derived command-and-control channel. It queries public Ethereum RPC endpoints (1rpc[.]io, eth[.]drpc[.]org, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io) and the blockscout API (eth-blockscout[.]com/api) to scan blocks for a transaction originating from a hardcoded wallet address. It then reads the transaction's recipient field, splits it into two 4-byte IP octets, and uses those octets to construct C2 hosts (hxxp://{ip}:80 and hxxp://{ip}:443). It fetches XOR-encrypted second-stage payloads from the C2 paths /0x/cls and /0x/ls, decrypts them with embedded keys, and executes the resulting JavaScript either via eval() or by spawning a detached `node -e <payload>` process. The package contacts these RPC endpoints at runtime to obtain the current block number.