The @rentwise/common npm package version 1.0.36 includes a malicious payload appended to its legitimate exports. This payload decodes and executes a base64-encoded script that queries public Ethereum JSON-RPC nodes and an API to obtain the latest transaction from a hardcoded wallet address. It reconstructs an IPv4 address from the transaction data and sends HTTP GET requests to this address to retrieve further payloads. These payloads are XOR-decoded and executed both in-process via eval() and as detached child Node.js processes. The use of blockchain transactions as a command-and-control mechanism allows the attacker to rotate infrastructure dynamically. The malicious code uses obfuscation techniques such as Unicode escaping to evade static detection. This vulnerability enables arbitrary remote code execution on any host that installs and loads the affected package.

Any system that installs and requires @rentwise/common version 1.0.36 is subject to arbitrary remote code execution by the attacker. This can lead to full compromise of the host environment, unauthorized code execution, data theft, or further lateral movement. The blockchain-based command-and-control mechanism allows the attacker to dynamically update the payload and infrastructure, complicating detection and remediation.

No official patch or remediation is currently documented. Users should immediately avoid installing or using @rentwise/common version 1.0.36. Audit existing environments for usage of this package and remove or replace it. Monitor for suspicious network connections to unknown IP addresses, especially those derived from Ethereum blockchain transactions. Check vendor advisories or trusted security sources for updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.