@next-fonts/font@1.0.1

Analysis

@next-fonts/font is a combosquat of Next.js's next/fonts. Its Inter() export, which should return font style metadata, instead spawns a detached node process running a base64-encoded loader. The loader fetches an encrypted payload from blockchain RPC endpoints (bsc-dataseed[.]binance[.]org, bsc-rpc[.]publicnode[.]com, api[.]trongrid[.]io, api[.]fullnode[.]mainnet[.]aptoslabs[.]com), XOR-decrypts it with a hardcoded key, and executes it via eval. The remote code is fetched from a BSC transaction and decrypted at runtime, so the executed payload is attacker-controlled and not present in the package itself.