iconova-react@1.30.1

Analysis

iconova-react@1.30.1 is a trojanized clone of the lucide-react icon library. The icon module files dist/esm/icons/sparkles.mjs and sparkle.mjs contain an injected payload that runs immediately when any icon is imported. The payload hardcodes the Ethereum address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a and queries public Ethereum RPC endpoints (1rpc[.]io/eth, eth[.]drpc[.]org, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io) to find a transaction sent from that address. It decodes the transaction's recipient address into two C2 server IPs, then connects to hxxp://<ip>:443/0x/cls and hxxp://<ip>:443/0x/ls, XOR-decrypts the response, and executes the fetched code via eval() and a detached node child process, giving the attacker remote code execution on the installer's machine. It falls back to the eth[.]blockscout[.]com/api txlist endpoint for transaction lookup. All strings are unicode-escaped to hide the behaviour.