myria-core-sdk@0.0.248

Analysis

myria-core-sdk@0.0.248 contains a three-stage malware dropper disguised as a blockchain SDK. The entry point dist/cjs/src/clients/MyriaClient.js requires dist/umd/umd.min.js, passing the USDT contract address as a gate key. umd.min.js reads sibling index.min.js and spawns it as a detached node process. index.min.js verifies the base64-encoded argument then downloads a second-stage payload from moonchain[.]cloud (decoded from base64 URL) to a platform-dependent path (~/Library/Application Support/Code/Scripts/NpmLibrary on macOS, equivalent on Linux/Windows), patches the shebang, and executes it as a detached process with up to 3 retries. The package has no install hook but the payload activates whenever the SDK class is instantiated. moonchain[.]cloud is not an allowlisted installer host.