@zahlen/checkout-angular@0.1.4

Analysis

The Angular module fesm2022/zahlen-checkout-angular.mjs contains an eval(atob(...)) payload that runs when the module is imported. The payload queries the Ethereum blockchain (via eth[.]blocsout[.]com/api and public RPC endpoints) for a transaction from attacker address 0xa3322E5f33D311D3308065f3012310639aDC2490Ef1a, decodes the transaction's `to` field into an IPv4 address, then connects to that address over HTTP (ports 80/443) and fetches XOR-encrypted second-stage payloads which it executes via eval or by spawning a detached node process. The C2 endpoint is dynamically derived from the attacker's blockchain activity rather than a fixed host.