eth-react-redirection@1.0.0
Malicious code in eth-react-redirection (npm)
Analysis
eth-react-redirection@1.0.0 is a trojanized package that masquerades as a React navigation library but contains no React code. On require(), it spawns a detached background Node.js process. The package also contains a C2 beacon in lib/levels.js that makes an HTTP GET request to mongos-hooks-api[.]vercel[.]app/defy/v3 with a custom authorization header. If the C2 responds with HTTP 404 and a .token field in the body, that field is executed as arbitrary JavaScript via the Function constructor, enabling remote code execution and second-stage payload delivery. The C2 endpoint is configured in lib/config.js (hxxp://mongos-hooks-api[.]vercel[.]app/defy/v3).
- analyzed by
- Leitwacht
- first seen
- Jul 10, 2026, 03:53 PM
- analyzed
- Jul 10, 2026, 03:54 PM
Related advisories
- chain-js-utils@2.1.1
- chain-await-dom@1.3.4
- chai-as-structured@7.0.5
- vite-pwa-config@1.1.1
- chai-as-disarmed@3.2.3
- zredis-typed@1.0.127
- zod-pino434@1.0.127
- polygon-gamma-apis@1.5.2
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.