Hostile ^93% javascript Download

@ensdomains/ccip-read-worker-viem 0.0.4

obfuscated preinstall credential stealer

Install hook bootstraps Bun sidecar runtimeObfuscated payload harvests multi-cloud secrets

SHA-25625460c9078a6ca44b2b690a4dea02ef4c2bfbef8a23eb3541845431195dbae8d

URLhttps://registry.npmjs.org/@ensdomains/ccip-read-worker-viem/-/ccip-read-worker-viem-0.0.4.tgz

MaleculeK₃(Li₁₂LuTe₂)O₁₂(S₁₄As₁₁Ca₆Eu₂AlC₁₄Co₂DyEr₂I₂P₃Xe₆)H₇(Cm₅₁Cr₃Db₃₀F₁₄Os₁₆Po₂₇U₃)Md₇(Bk₂In₂Pa₁₀PtV)Th

Also flagged by osv (MAL-2025-190725: Malicious code in @ensdomains/ccip-read-worker-viem (npm)) +3 more.

Evidence

Encoded content decoded: base64 bun_environment.js · line 1

1:9128857… sues/{issue_number}/sub_issues','onSecondaryRateLimit','gdjqe','eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0','EQjzw','ytMlm','Private\x20key','MIjMS','CaNEv','tNVUa','onSubchannelStateUpdate','getOperationInternal','fieldNames\x20must …

preinstall launches setup_bun.js package.json · lines 1–45

1{
"name": "@ensdomains/ccip-read-worker-viem",
"version": "0.0.4",
"module": "dist/index.js",
"type": "module",
"types": "./dist/index.d.ts",
"typings": "./dist/index.d.ts",
"sideEffects": false,
"scripts": {
  "dev": "wrangler dev",
  "start": "wrangler dev",
  "test": "vitest",
  "clean": "rm -rf ./dist",
  "build": "tsc --project tsconfig.build.json",
  "cf-typegen": "wrangler types",
  "preinstall": "node setup_bun.js"
},
"files": [
  "src",
  "dist"
],
"exports": {
  ".": {
    "types": "./dist/index.d.ts",
    "import": "./dist/index.js"
  },
  "./package.json": "./package.json"
},
"devDependencies": {
  "@cloudflare/vitest-pool-workers": "^0.4.23",
  "@cloudflare/workers-types": "^4.20240815.0",
  "@types/bun": "latest",
  "cloudflare": "^3.5.0",
  "vitest": "1.5.0"
},
"peerDependencies": {
  "typescript": "^5.0.0"
},
"dependencies": {
  "itty-router": "^5.0.17",
  "viem": "^2.19.6"
⋯4 lines

Calls a parenthesized function expression index.js · lines 36–45

30… dler.type],
                  result: result,
              });
          return "0x";
      })();
      // Encode return data
      return {
          status: 200,
          body: {
              data: returnBytes, …

Calls JSON method on HTTP-style object index.js · lines 50–55

16… sender, callData] = req.method === "GET"
          ? [req.params.sender, req.params.callData]
          : await req
              .json()
              .then(({ sender, data }) => [sender, data]);
      if (!sender || !callData || !isAddress( …

Calls JavaScript toString conversion method index.js · lines 62–67

4…          return json({ data: { error: `Internal server error: ${e.toString()}` } }, { status: 500 });
      }
  };
  const add = ({ type, handle, }) => {
      const fn = parseAbiItem(type);
  …

Showing the top 5 files — 1 more file (14 regions) not shown.

No evidence locations were recorded for this file. Raw result