The anhn-cli npm package version 1.1.4 includes a heavily obfuscated Immediately Invoked Function Expression (IIFE) appended to its install.js script. This payload queries public Ethereum RPC endpoints and etherscan.io for transactions from a hardcoded Ethereum address. It decodes the transaction 'to' field as an IPv4 address, fetches an XOR-encrypted payload from that host, decrypts it, and executes it via eval and a detached Node.js process. Because the main entry point requires the install script unconditionally, the malicious code runs on package import or CLI invocation. The attacker controls the payload by publishing Ethereum transactions, effectively rotating the destination host dynamically. There is no version pinning or signature verification, allowing ongoing remote code execution controlled via the blockchain.

This vulnerability enables remote code execution on any system that installs or requires the anhn-cli package version 1.1.4. The attacker can dynamically control the payload executed, potentially leading to full system compromise, data theft, or further malware deployment. The malicious code runs automatically without user interaction beyond installing or invoking the package.

No official patch or remediation is currently documented. Users should immediately avoid installing or using anhn-cli version 1.1.4. Remove any existing installations of this package. Monitor for updates or advisories from the package maintainers or npm registry. Consider using package integrity verification and restricting installation of untrusted packages.