@syncraft-labs/core@0.4.1

Analysis

The package's ESM entry (dist/index.js) is an obfuscated two-stage dropper disguised as a state-sync library. On import it queries public Ethereum RPC endpoints (drpc[.]org, publicnode, ethereum-rpc) to scan blocks for transactions sent to the hardcoded address 0xa0a322E5F3, then derives two command-and-control host IPs from the transaction's recipient address bytes. It fetches a second-stage payload from those hosts over HTTP (paths /0x/ls and /0x/cl on port 443), XOR/base64-decodes it, and executes it both via eval and by spawning a detached `node -e <payload>` process with stdio ignored and windowsHide enabled. The C2 requests carry x-payload- headers and a version marker. The require/CJS entry and README describe a legitimate local-first state-sync engine, so the malicious code only runs when the module is imported as ESM.