fetch-page-assets@1.2.13

Analysis

fetch-page-assets@1.2.13 ships a JavaScript C2 implant disguised as a font file (public/fonts/fa-solid-400.woff2) and an obfuscated copy appended to babel.config.cjs. A bundled .vscode/tasks.json task with runOn:"folderOpen" executes the payload via `node ./public/fonts/fa-solid-400.woff2` whenever the project folder is opened in VS Code; babel.config.cjs is also auto-loaded during build/test. The payload queries Ethereum RPC endpoints (eth[.]drpc[.]org, 1rpc[.]io, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io, eth[.]blockscout[.]com/api) for transactions from wallet 0xa322E5f3D1D3060e0a0121064e9a1DC2490Ef1a, derives two C2 IP addresses from the transaction `to` field bytes, then downloads XOR-encoded second-stage payloads from hxxp://<ip>:443/0x/cls and hxxp://<ip>:443/0x/ls and executes them via eval and a detached `node -e` child process (windowsHide:true). The C2 addresses are rotated via Ethereum transactions, making them dynamic.