🛡️ MAL-2026-12324 — common

Malicious code in @nasdtickets/common (npm)

Source: amazon-inspector

build/index.js (the package main) appends a hidden eval(atob('...')) block after the legitimate __exportStar boilerplate, separated by a long run of tab characters to push it off-screen in editors. On every require/import of the package, the decoded payload queries an Ethereum RPC/Blockscout endpoint for the latest transaction of the hardcoded EOA 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, interprets the 20-byte tx.to address as two encoded IPv4 addresses, and issues HTTP requests to http://<resolved-ip>:443/0x/cls and http://<resolved-ip>:443/0x/ls. The response carries a payload in the x-payload-b64 header that is XOR-decoded and then executed via spawn('node', ['-e', <decoded>], {detached: true, stdio: 'ignore', windowsHide: true}).unref(), launching a detached hidden Node process on the installer's machine. Module identifiers such as 'http', 'https', 'child_process', and 'spawn' are unicode-escaped (\u00XX) to further hide the behavior. The combination of on-chain C2 resolution (resistant to DNS/domain takedown), multi-layer obfuscation, and hidden detached process execution on import is a remote-code-execution supply-chain attack against any project that installs this version.

Source: ghsa-malware

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.