zenntechinc-cli@1.6.4

Analysis

The zenntechinc-cli package ships a backend project template whose .eslintrc.js file contains a legitimate ESLint config followed by an appended obfuscated payload. The payload is a blockchain-based command-and-control dropper: it queries public Ethereum RPC endpoints (hxxps://1rpc[.]io/eth, hxxps://ethereum-rpc[.]publicnode[.]com, hxxps://eth-mainnet[.]publicnode[.]com, hxxps://eth[.]drpc[.]org) and an Etherscan-style indexer API to scan blocks for a transaction from a hardcoded sender address, then decodes the transaction's recipient address into two IPv4 addresses. It connects to hxxp://<decoded-ip>/0x/ls and hxxp://<decoded-ip>/0x/cl on those addresses, fetches XOR-encrypted second-stage payloads, decrypts them, and executes them both via eval() and by spawning a detached 'node -e <payload>' process. The C2 server IP is hidden in an on-chain Ethereum transaction, making the channel covert. The payload is copied into every project generated by the CLI and executes when the generated project loads its ESLint config.