@wizloft/harness-validation@0.1.1-alpha.3

Analysis

@wizloft/harness-validation@0.1.1-alpha.3 ships an obfuscated Ethereum wallet drainer appended to dist/index.js after legitimate validation code. On module import the payload bootstraps global require, spawns child processes, and queries Ethereum RPC endpoints (eth[.]drpc[.]org, ethereum-rpc[.]publicnode[.]com, 1rpc[.]io/eth, plus the ETH_RPC_URL env var) and block-explorer APIs (stapi[.]io, ut[.]com/api) using etherscan-style parameters (?module=account, action=txlist, sort=desc, page=1, offset=20, count=9999999) to enumerate the victim's on-chain transactions and approvals. It uses eth_getTransactionCount, eth_getBlockByNumber, eth_getTransactionByHash and eth_getTransactionReceipt RPC methods and exfiltrates results via an x-payload- header and Telegram-style _t_u/_t_s markers to drain wallet funds to a hardcoded address (0xa322E5f3).