simplipayng@1.0.8

Analysis

The package's dist/index.js contains an eval(atob(...))-obfuscated payload that acts as a blockchain-C2 dropper. On load it queries public Ethereum RPC endpoints (ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io, 1rpc[.]io/eth, eth[.]drpc[.]org) with eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount / eth_getBalance to locate transactions sent to the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a. It derives a C2 IP address from the transaction's `to` field, then fetches second-stage payloads from hxxp://<ip>:443/0x/cls and hxxp://<ip>:443/0x/ls and executes them by spawning detached `node -e` child processes (spawn with detached:true, stdio ignored, windowsHide). The RPC endpoints and the /0x/cls and /0x/ls C2 paths are the network indicators.