@zahlen/checkout-react@0.1.1

Analysis

@zahlen/checkout-react@0.1.1 (a "React payment modal" component) executes a hidden payload on import. Its bundled index.esm.js ends with eval(atob(...)) that decodes an Ethereum wallet-drainer / C2 beacon. The payload connects to public Ethereum JSON-RPC endpoints (1rpc[.]io/eth, eth[.]drpc[.]org, eth-mainnet[.]public[.]blastapi[.]io, ethereum-rpc[.]publicnode[.]com), reads the latest block, and searches for a transaction sent to the hardcoded address 0xa322e5f33d311d33080e6f301210636e9adc2490ef1a. It then derives two IP addresses from the first 8 bytes of that transaction's `to` field and spawns detached node processes that beacon to hxxp://<ip>:80 and hxxp://<ip>:443, using the derived IPs as command-and-control endpoints. The C2 endpoints are thus dynamically derived from blockchain data rather than hardcoded.