envpack-conf@1.0.1

Analysis

envpack-conf@1.0.1 is a trojanized package: it presents as a config-reading utility but its module entry (index.js) runs a covert command-and-control dropper on import. It queries public Ethereum RPC endpoints (1rpc[.]io/eth, eth[.]drpc[.]org, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io) and the Blockscout API (eth[.]blockscout[.]com/api) to watch for a transaction from attacker-controlled address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a. When found, it decodes the transaction's recipient address bytes into two IPv4 C2 server IPs, then fetches XOR-encrypted second-stage payloads from hxxp://<ip>:443/0x/cls and hxxp://<ip>:443/0x/ls, decrypts them with hardcoded XOR keys, and executes them via eval and a detached `node -e` child process. It also installs global backdoor hooks (global.r=require, global.m=module). The C2 server addresses are delivered covertly through the Ethereum blockchain transaction recipient field.