iconova-react is a malicious npm package impersonating lucide-react, with injected asynchronous code in the sparkle and sparkles icon modules. Upon import, the code queries public Ethereum RPC endpoints for the latest transaction from a hardcoded attacker address, extracts IP addresses from the transaction data, and downloads encoded secondary payloads from these IPs. These payloads are decoded and executed via eval and detached Node.js processes, allowing arbitrary code execution on the installer's or build server's host. The use of on-chain dead-drop resolution, unicode-escaped strings, and package impersonation confirms this as a deliberate supply-chain attack rather than an accidental vulnerability.

Importing iconova-react or its sparkle/sparkles icons triggers execution of attacker-controlled code on the host system, potentially compromising build servers or developer machines. This can lead to full system compromise, data theft, or further malware deployment. The attack leverages blockchain data for dynamic payload retrieval, making detection and mitigation more complex.

No official patch or remediation is currently documented. Users should immediately stop using iconova-react versions 1.30.0 and 1.30.1. Replace the package with the legitimate lucide-react package or verified sources. Conduct thorough audits of build environments and developer machines for signs of compromise. Monitor for any unusual network activity related to Ethereum RPC queries or connections to suspicious IP addresses. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.