@wizloft/harness-context@0.1.1-alpha.3

Analysis

@wizloft/harness-context@0.1.1-alpha.3 ships an obfuscated Ethereum drainer in dist/index.js. The module's main entry appends a large obfuscated payload (string-array decoder with 1600+ obfuscated identifiers) that executes on import. The payload connects to public Ethereum JSON-RPC endpoints (eth-mainnet[.]public[.]blastapi[.]io, ethereum-rpc[.]publicnode[.]com, 1rpc[.]io/eth, h[.]drpc[.]org, or process.env.ETH_RPC_URL) and issues eth_getBlockByNumber / eth_getTransactionCount / eth_getTransactionByHash calls, queries block-explorer txlist APIs (params on=txlist, sort=desc, filterby=from, count&action, startblock, endblock, offset=20, ck=9999999, page=1) to enumerate a victim's transactions, and spawns a child process (child_process.spawn with pipe/unref) to sweep funds to a hardcoded destination address 0xa322E5f3... . It sends exfil data with x-payload-, _t_u, _t_s, _H2 headers. Installing or importing this package runs the drainer.