fsbrowse@0.2.28

Analysis

fsbrowse@0.2.28 is a minimal HTTP file server whose index.js carries an appended blockchain dead-drop C2 implant. On load it queries public Ethereum RPC endpoints (1rpc[.]io, eth[.]drpc[.]org, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io) and the Etherscan-compatible API at eth[.]blockscout[.]com for the latest transaction sent from the attacker-controlled address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a. The recipient field of that transaction is split into two IPv4 addresses that become the C2 hosts. The implant then fetches XOR-encrypted second-stage payloads from hxxp://<ip>:443/0x/cls and hxxp://<ip>:443/0x/ls, decrypts them with a hardcoded key, executes them via eval, and additionally spawns a detached `node -e` process running the decrypted payload. The C2 IP is thus published on-chain by the attacker and discovered at runtime, so the destination is not fixed in the package.