godot-kit@1.0.1786316795

Analysis

godot-kit@1.0.1786316795 ships a hidden remote-code-execution dropper appended to lang/gdscript.js. On load, the payload hardcodes the Ethereum wallet 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a and queries public ETH RPC endpoints for transactions sent FROM that wallet; it decodes the `to` field of a matching transaction as hex to derive two C2 IP addresses. It then fetches XOR-encrypted second-stage payloads (keys q4FZkxX{!h,Sr3=@ and y-p_>d$0B&@^1aQk) from hxxp://<c2-ip>:443/0x/cls and hxxp://<c2-ip>:443/0x/ls, decrypts them, and executes them both via eval and by spawning a detached, hidden `node -e` process. The C2 rendezvous is hidden in Ethereum blockchain transactions, so the C2 IPs are only resolvable at runtime.