anhn-cli@1.1.4

Analysis

anhn-cli@1.1.4 ships an obfuscated crypto wallet drainer appended to bin/install/install.js. The payload builds an HTTP/HTTPS RPC client that queries Ethereum endpoints (h[.]drpc[.]org, h-mainnet[.]pc[.]io, stapi[.]io, 1r...ut[.]com/api, et...e[.]com, plus the ETH_RPC_URL env var) for the attacker-controlled address 0xa322E5f3, issuing eth_blockNumber, eth_getTransactionCount, eth_getBalance, eth_getBlockByNumber and eth_getTransactionByBlockNumberAndIndex calls, and enumerating transactions via block-explorer API query strings (?module=ac, on=txlist&, filterby=fr, ort=desc&f, ck=9999999). It also references C2 paths :443/0x/ls and :443/0x/cl, sends an x-payload- header, and spawns child processes. The package's other commands (git commit helper, Harvest time-entry, open-site) are benign cover for the injected drainer.