react-scroll-disable@2.5.2

Analysis

A combosquat of the legitimate react-remove-scroll package. The dist/index.js files (es5, es2015, es2019) each append an eval(atob(...)) payload after the legitimate export. The payload queries Ethereum JSON-RPC endpoints (1rpc[.]io, eth[.]drpc[.]org, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io) to find the latest block, then searches for a transaction from a hardcoded wallet address. The recipient address from that transaction is split into two IPv4 addresses that become the C2 servers. The implant then makes XOR-encrypted HTTP requests to those C2 IPs on ports 80 and 443, fetching second-stage payloads. One request path (/0x/cls) evals the decrypted response inline; another (/0x/ls) spawns a detached node process to run the decrypted payload. The C2 communication uses XOR encryption with a key derived from the transaction data, and responses carry base64-encoded payloads in the x-payload-b64 header.