Malicious code in html-to-gutenberg (npm)

The html-to-gutenberg npm package includes a malicious file disguised as a FontAwesome font variant that is executed silently via a VS Code task configured to run on folder open. This loader queries Ethereum RPC endpoints and a blockchain indexer to retrieve the latest transaction from a hardcoded sender address. It decodes recipient addresses into two IPv4 command and control servers, from which it fetches XOR-encoded payloads. These payloads are executed dynamically using eval and detached Node.js processes, enabling remote code execution and persistent compromise of the developer workstation. This attack combines stealthy auto-execution, blockchain-based C2 rotation (EtherHiding), and arbitrary code execution.

Any system with this package installed or running is considered fully compromised. The attacker gains persistent remote code execution capabilities, potentially accessing all secrets and keys stored on the machine. Removal of the package does not guarantee elimination of all malicious artifacts or backdoors, as full control may have been established.

Immediate removal of the html-to-gutenberg package versions 4.2.11 through 4.2.22 is required. All secrets and keys stored on affected machines should be rotated from a separate, trusted system. Due to the high likelihood of full system compromise, a thorough incident response including forensic analysis and system rebuild is recommended. Patch status is not confirmed; check vendor advisories for updates. No official fix or patch links are provided in the source data.