@kolbo/mcp@1.57.1

Analysis

@kolbo/mcp@1.57.1 ships a hidden C2 implant appended to src/auth.js. On load, the payload hardcodes the Ethereum wallet 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a and queries the Ethereum blockchain (via 1rpc[.]io/eth, eth[.]drpc[.]org, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io, and eth[.]blockscout[.]com/api) for the latest transaction sent FROM that wallet. It decodes the transaction's `to` field into two IPv4 addresses, which become the C2 server (ports 80 and 443). It then fetches XOR-encrypted second-stage payloads from hxxp://<c2-ip>:443/0x/cls and /0x/ls, decrypts them, and executes them via eval() and by spawning detached `node -e` child processes. The C2 address is not hardcoded — it is derived from the blockchain at runtime, so the implant can be re-pointed by the operator publishing a new transaction.