@next-fonts/font is a malicious npm package designed to impersonate the legitimate Next.js @next/font package. Its Inter() function decodes a base64-encoded payload which it executes via a detached Node.js process or eval fallback. The payload uses blockchain data from public RPC endpoints as a command and control channel, retrieving transaction input data linked to hardcoded wallet addresses. This data is XOR-decrypted and then executed as JavaScript code, enabling arbitrary attacker-controlled code execution in any Node.js environment that imports the package and invokes Inter(). The malicious code is heavily obfuscated to evade casual detection.

Any Node.js process importing @next-fonts/font and invoking its Inter() function is at risk of executing arbitrary attacker-controlled code. This can lead to full compromise of the host environment, data theft, or further malicious activity. The package does not perform any legitimate font-related functionality, so its presence indicates a supply chain compromise or typosquatting attack vector.

No official patch or remediation is currently documented. Users should immediately remove and avoid using the @next-fonts/font package. Verify dependencies to ensure the legitimate @next/font package is used instead. Monitor for any usage of this malicious package in your projects and supply chain. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.