The @hoteldev/common npm package version 1.0.9 includes obfuscated malicious code that appends an eval(atob(...)) block to the module exports. This block acts as a loader that queries the Ethereum blockchain for a transaction linked to a specific wallet address to derive a C2 server IP. It then sends HTTP requests with encoded headers to this server, XOR-decrypts the responses, and executes the resulting code as detached Node.js processes. The malicious strings are encoded as Unicode escapes to evade casual code review. This behavior triggers on any import or require of the package, allowing the attacker to run arbitrary code on the host system stealthily.

This malicious package enables an attacker to achieve arbitrary, hidden, and detached code execution on any machine that installs and imports @hoteldev/common version 1.0.9. The attacker can rotate the C2 server address dynamically via Ethereum transactions, complicating detection and response. This poses a severe risk of system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented. Users should immediately remove and avoid installing version 1.0.9 of @hoteldev/common. Audit existing environments for this package and replace it with trusted alternatives. Monitor for suspicious Node.js processes spawned detached from normal workflows. Check vendor advisories or npm security advisories for updates or official fixes.