@syncraft-labs/react@0.4.1

Analysis

The ESM build (dist/index.js) of this React hooks package contains an obfuscated crypto-drainer payload that executes inside a useEffect hook. It connects to Ethereum JSON-RPC endpoints (eth[.]drpc[.]org, 1rpc[.]io/eth, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]publicnode[.]com, plus the ETH_RPC_URL env var) and issues eth_getBlockByNumber, eth_getTransactionByHash, and eth_getBalance calls, and queries api[.]etherscan[.]io/api?module=account&action=txlist to enumerate transactions. It monitors for deposits to a hardcoded wallet address (0x219f322.../0xa322E5f3...) and reports balances and transaction data to command-and-control endpoints at :443/0x/ls and :443/0x/cl using x-payload- HTTP headers. It also spawns child processes via child_process. The CJS build is clean; only the ESM entry is trojanized.