Malicious code in fetch-page-assets (npm)

The fetch-page-assets npm package versions 1.2.9, 1.2.13, and 1.2.14 include heavily obfuscated malicious code within babel.config.cjs and a file disguised as a font (public/fonts/fa-solid-400.woff2). The malicious code queries multiple Ethereum RPC endpoints for transactions from a specific on-chain address to dynamically retrieve XOR-encrypted secondary payloads from attacker-controlled C2 servers. These payloads are decrypted with hardcoded keys and executed locally via eval and detached Node.js processes. The code uses Unicode-escaped requires to evade static detection. This mechanism provides the attacker with resilient, takedown-resistant remote code execution capabilities on any machine that installs and runs this package in a Babel-based environment such as jest, build, or transpile workflows.

Systems that install and run fetch-page-assets versions 1.2.9, 1.2.13, or 1.2.14 with Babel-based workflows are subject to remote code execution by attacker-controlled payloads. This results in full compromise of the affected computer, including potential unauthorized access to secrets and keys stored on the system. The attacker gains persistent, resilient command-and-control capabilities that are dynamically resolved via the Ethereum blockchain, making takedown and remediation difficult.

No official patch or remediation is currently documented. Immediate removal of the fetch-page-assets package versions 1.2.9, 1.2.13, and 1.2.14 is strongly recommended. All secrets and keys on affected systems should be rotated from a separate, uncompromised device. Due to the nature of the compromise, assume full system compromise and consider rebuilding the affected machines. Monitor for any suspicious activity related to this package and avoid using it until a verified clean version is available.