MAL-2026-12005 Malicious code in webdev-conf (npm)

[email protected] is a typosquat of the sindresorhus/pkg-conf library, published under author 'Sinde Sorus' <[email protected]> (homoglyph of Sindre Sorhus). index.js appends an eval(atob(…)) block after the legitimate library code. On require(), the decoded payload queries public Ethereum RPC endpoints and blockscout.com/api for the latest transaction sent from the attacker address 0xa322E5f3D311D3080e6f01210263e9aDC2490Ef1, extracts an IP address from that transaction, then fetches XOR-encrypted next-stage JavaScript from http://<IP>:443/0x/cls and http://<IP>:443/0x/ls, eval()s it in-process, and re-executes it via spawn('node', ['-e', payload], {detached:true, windowsHide:true}).unref(). Identifiers such as http, https, child_process, spawn, and the RPC URLs are hidden with \uXXXX unicode escapes. The C2 IP is rotatable by the attacker via on-chain transactions (EtherHiding technique). Any package that require()s webdev-conf triggers remote code execution on the installer's host.