simple-auth-basic@2.0.2

Analysis

Combosquat of the basic-auth package. When imported, the module executes two eval(atob(...)) calls at runtime that fetch remote JavaScript from hxxps://coingecko-liard[.]vercel[.]app/api/content and hxxps://coingecko-liard[.]vercel[.]app/api/old, then eval the response. This gives the attacker full remote code execution in the context of the importing application. The package ships no detection of the C2 host in its listed dependencies (it requires axios at runtime but does not declare it in package.json).