evm-typechain@0.5.4

Analysis

evm-typechain@0.5.4 is a combosquat package impersonating the TypeChain Ethereum tooling ecosystem. The package ships a trojanized clone of a Mongoose plugin with an injected remote code execution payload. When the package is required (require('evm-typechain')), it fetches a second-stage payload from hxxps://www[.]jsonkeeper[.]com/b/PC5CK and executes it via new Function('require', ...), giving the attacker arbitrary code execution in the context of the importing application. The README describes a TypeScript Ethereum typechain toolkit, but the actual code is a Mongoose schema plugin with the injected downloader — the package does not deliver the described functionality.