chain-guardian@1.1.0

Analysis

chain-guardian@1.1.0 is a trojanized version of the legitimate chain-guardian Ethereum gas reporter. When the package is loaded (require'd), it spawns a detached background Node.js process that fetches attacker-controlled code from hxxp://check-server-state[.]vercel[.]app/server/v2 and executes it via new Function('require', ...), allowing the remote server to run arbitrary code on the installer's machine. The C2 request uses a hardcoded bearer token "gemini". The package has no repository, no lifecycle hooks, and its code is a clone of the real chain-guardian with the malicious payload injected into index.js and lib/utils.js.