events-runtime@3.2.3

Analysis

This package masquerades as a drop-in replacement for the standard `events` event-emitter polyfill: its events.js is a verbatim copy of the legitimate EventEmitter source with one hidden block inserted into the emit() method. When an event is emitted whose first argument carries a sentinel property (eventId === "eventId0"), the patched emit silently launches a detached, output-suppressed, hidden background Node process running a bundled minified script in tests/. That script is a multi-stage dropper. It reads attacker-controlled data from a smart contract on the Sepolia Ethereum testnet (via public RPC), derives an x25519/AES-GCM key, and decrypts the on-chain blobs into an executable file which it marks 755 and runs as a further detached child process — an on-chain (EtherHiding-style) command-and-control channel whose payload can be swapped by the attacker and which evades URL/domain blocklists. It also harvests host fingerprint data (platform, release, architecture, hostname, CPU and memory details, uptime) together with a generated public key and exfiltrates it to Telegram (api[.]telegram[.]org sendMessage) and Slack (chat.postMessage) using hardcoded bot/bearer tokens. Finally it performs anti-forensic cleanup: it deletes its own payload files and rewrites the parent events.js to splice out the malicious block, so later inspection shows only a benign events shim.