wallet-analytics@1.4.8

Analysis

wallet-analytics@1.4.8 is a combosquat package impersonating a blockchain analytics SDK. Its main entry point (index.js) contains a remote code execution downloader: on import, it fetches a payload from hxxps://46[.]183[.]25[.]232:45000/icons/109 and executes the response body via new Function() with full Node.js globals (require, process, Buffer, console), giving the attacker arbitrary code execution in the installer's environment. The package has no lifecycle hooks — the payload runs immediately when the module is required. The README is a fabricated description of a blockchain analytics platform; the actual code performs none of those functions.