runtimekit@1.1.0

Analysis

runtimekit@1.1.0 is a TypeScript validation library that embeds a remote-code-execution dropper in lib/index.cjs. On load it queries public Ethereum RPC endpoints (1rpc[.]io/eth, eth[.]drpc[.]org, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io, or the ETH_RPC_URL env var) for the latest transaction from wallet 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the transaction's `to` field into two IPv4 addresses, and uses those as command-and-control hosts (hxxp://<ip>:80 and :443). It fetches payloads from the C2 at paths /0x/cls and /0x/ls, reading a base64-encoded payload from the x-payload-b64 response header, then executes the fetched code via eval() and by spawning a detached `node -e` process. The C2 addresses are laundered through the attacker's own Ethereum transactions.