events-runtime@3.2.2

Analysis

events-runtime is a typosquat of Node.js core events package: events.js is a near-verbatim copy of the legitimate EventEmitter with a hidden modification to its emit() method. When an event is emitted whose first argument carries a marker property (eventId == "eventId0"), emit() silently launches a detached, output-suppressed background Node process running a bundled, heavily obfuscated script (tests/galas-emit.min.js). That script: collects detailed host reconnaissance (OS platform/release, architecture, hostname, CPU count, total/free memory, uptime) and exfiltrates it as a formatted system report to both a Telegram bot and a Slack workspace using hard-coded, base64-encoded API tokens; establishes a blockchain-based command-and-control channel by querying and subscribing to events on an Ethereum Sepolia smart contract (via Infura with an Alchemy fallback), reading encrypted payloads from on-chain getter methods and TData update events; derives AES-GCM keys via x25519 Diffie-Hellman and PBKDF2 to decrypt the on-chain data; writes and executes a second-stage binary/file (subwatcher) with mode 755 as a further detached process; and performs anti-forensic self-destruction by deleting its own files, splicing the injected lines back out of events.js, stripping a license string, and killing its prior process. The package has no legitimate added functionality beyond the cloned event emitter and exists solely to deliver this exfiltration and remote-control payload.