solidity-testing-utils@1.2.0

Analysis

solidity-testing-utils@1.2.0 is a trojanized clone of the pino logger that installs a remote-code-execution dropper. The package's index.js spawns a detached background node process running lib/caller.js. That script base64-decodes a hardcoded jsonstorage[.]net URL (hxxps://api[.]jsonstorage[.]net/v1/json/2ef8c758-a96f-4e9e-b036-b3b90379a165/f2f8264-86c2-4684-94da-c3f52f5d70f) and fetches it with header x-secret-key: _, then executes the returned payload via the Function constructor with the require function in scope, retrying up to 5 times. The fetched payload is arbitrary attacker-controlled code executed with full Node.js module access.