@vboxdev/common@1.0.73

Analysis

@vboxdev/common@1.0.73 ships an obfuscated eval(atob(...)) payload appended to build/index.js. On load it queries public Ethereum RPC endpoints (1rpc[.]io/eth, eth[.]drpc[.]org, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io) to locate the latest block containing a transaction from hardcoded address 0xa3322e5f33d3311d3308e6f0121063e9aDC2490Ef1a. It reads the transaction's `to` field, whose first 4 bytes encode an IP address, then spawns a detached node process that beacons to hxxp://<ip>:80 and hxxp://<ip>:443 with XOR-encoded payloads — a blockchain dead-drop command-and-control channel whose C2 IP is derived on-chain. The package also ships a live Firebase service-account private key in build/services/serviceAccountKey.json.