@nasddatax/common@1.0.21

Analysis

@nasddatax/common@1.0.21 is a trojanized clone of a standard express/nats microservices shared library (errors, middlewares, events) with an injected obfuscated dropper appended to build/index.js. On load, the payload decodes a base64 blob and queries public Ethereum RPC endpoints (1rpc[.]io/eth, eth[.]drpc[.]org, eth[.]blockscout[.]com, eth-mainnet[.]public[.]blastapi[.]io, and the ETH_RPC_URL env var) using JSON-RPC (eth_blockNumber, eth_getBlockByNumber, eth_getTransactionCount). It scans recent blocks for a transaction originating from attacker address 0x8322e5f33d311d3308e6f01210a363e9adc2490ef1a, reads the transaction's `to` field, and derives two IPv4 C2 addresses from the first 8 bytes of that address. It then connects to hxxp://<c2-ip>:443/0x/cls and /0x/ls, fetches a second-stage payload, and executes it in a detached `node -e` child process. Requests use XOR-encoded bodies with a Sec-V header. The C2 IP is delivered on-chain, so it changes per transaction.