Malicious code in eth-batcher (npm)

The 'eth-batcher' npm package version 1.0.0 is a malicious package that contains an obfuscated payload appended to a benign source file. The payload is encoded as a hex byte table and decoded via an XOR/rotation decoder, executing arbitrary code upon requiring the package. The package's advertised functionality related to Ethereum JSON-RPC batching is a cover for this malicious behavior, as the shipped code contains no Ethereum or Web3 logic. Any process importing this package will execute the hidden payload immediately.

Any application or process that imports 'eth-batcher' version 1.0.0 will execute the malicious payload embedded in the package. This can lead to arbitrary code execution within the context of the importing process, potentially compromising system integrity, confidentiality, and availability depending on the payload's intent.

No official patch or remediation is currently documented. Users should avoid using 'eth-batcher' version 1.0.0 and remove it from their dependencies if present. Verify the integrity and source of npm packages before installation. Monitor for updates or advisories from the package repository or security databases for further guidance.