The malicious code in @nasdtickets/common version 1.0.23 appends a hidden eval(atob('...')) block after legitimate exports, obfuscated with unicode escapes and whitespace to hide it from casual inspection. On import, it queries an Ethereum RPC endpoint for the latest transaction of a hardcoded externally owned account (EOA). It interprets the transaction's recipient address as two IPv4 addresses and sends HTTP requests to these resolved IPs to retrieve a base64-encoded payload from a custom header. This payload is XOR-decoded and executed by spawning a detached, hidden Node.js process on the victim's machine. This technique uses on-chain command and control (C2) resolution, making it resistant to traditional DNS or domain takedown, and constitutes a remote code execution supply-chain attack against any project that installs this specific package version.

Any project or system that installs and imports @nasdtickets/common version 1.0.23 is at risk of remote code execution due to the hidden malicious payload execution. The attacker can execute arbitrary code on the victim's machine without user interaction beyond installing the package, potentially leading to full system compromise or further malicious activity. The use of blockchain-based C2 makes detection and mitigation more difficult.

No official patch or fix is currently available for this malicious package version. Users should immediately avoid installing or importing @nasdtickets/common version 1.0.23. Remove this package from all projects and replace it with a trusted alternative or a clean version if available. Monitor dependency sources carefully and verify package integrity before installation. Since this is a supply-chain attack, consider auditing all dependencies for similar malicious behavior.