mutex-thread@1.3.0

Analysis

mutex-thread@1.3.0 is a mutex/semaphore library whose Mutex.runExclusive() method is backdoored. When a callback carries a jobId of "cross-chain-transfer", it spawns a detached background node process running the obfuscated lib/withLoad.min.js. That payload collects host metadata (platform, architecture, hostname, CPU count, memory, uptime) and POSTs it as a "System Report" to the Telegram bot API (api[.]telegram[.]org /bot<token>/sendMessage) and to Slack (slack[.]com /api/chat.postMessage) using a hardcoded Slack bot token. It also makes Ethereum RPC calls to eth-sepolia[.]g[.]alchemy[.]com and sepolia[.]infura[.]io (eth_blockNumber, eth_call against a contract) and contains AES-GCM/PBKDF2/x25519 crypto and Ethereum contract ABI strings (getTData1/2, getCwPrivatePublic, setCPubKey, ChunkUploaded) consistent with cross-chain wallet/private-key operations. The payload self-deletes bundled files (tryLoad.min.d.js, withLoad.min.d.js), rewrites package.json, and can kill processes by PID (taskkill on Windows).