@syncraft-labs/vue@0.4.1

Analysis

@syncraft-labs/vue@0.4.1 ships an obfuscated wallet-drainer payload in its ESM build (dist/index.js) that executes when the module is imported. The payload queries Ethereum RPC endpoints (eth[.]drpc[.]org, eth-mainnet[.]publicnode[.]com, ethereum-rpc[.]public[.]blastapi[.]io, 1rpc[.]io/eth, api[.]etherscan[.]io) to locate a transaction involving the victim's wallet, then derives a C2 host IP from the victim's transaction recipient-address bytes and fetches XOR-encrypted second-stage payloads from hxxp://<ip>/0x/ls and hxxp://<ip>/0x/cl. The decrypted payload is executed via eval() and also spawned as a detached 'node -e' child process (stdio ignored, windowsHide). A hardcoded attacker-controlled Ethereum address 0xa322E5f3... is embedded as the drain destination. The C2 host is computed from the victim's own address, so it varies per victim.