async-lock-queue@3.0.1

Analysis

async-lock-queue is a thin FIFO-queue wrapper whose sole dependency, mutex-forge, is a heavily-obfuscated implant. On install/require, mutex-forge's lib/withLoad.min.js fingerprints the host (hostname, platform, arch, CPU count, total memory, uptime), reads wallet/private-key files, and exfiltrates the collected data to a Telegram bot (api[.]telegram[.]org /bot<token>/sendMessage) and a Slack bot (slack[.]com /api/chat.postMessage) using embedded bot tokens. It also interacts with Ethereum smart contracts (getSPubKey/setCPubKey/getChunk) using embedded Alchemy and Infura RPC keys (eth-sepolia[.]g[.]alchemy[.]com, sepolia[.]infura[.]io), and encrypts its command channel with AES-GCM/PBKDF2/x25519. Installing async-lock-queue pulls in and executes this payload.