The @syncraft-labs/react package version 0.4.1 includes a malicious obfuscated code block in its ESM entry file (dist/index.js). This block uses obfuscation techniques and a large string array decoder to fetch code from Ethereum RPC endpoints and on-chain contract data. The contract is mutable, allowing operators to deliver arbitrary JavaScript code dynamically. The code executes with require access, enabling remote code execution in Node.js build or SSR environments and in browser bundles of downstream applications. The malicious code is not present in the CommonJS build or TypeScript source maps, indicating the ESM artifact was tampered with after the build process.

This vulnerability enables remote code execution in environments that consume the ESM build of the package, including Node.js server-side rendering and browser bundles. Attackers controlling the on-chain contract can deliver arbitrary JavaScript code to any application using the compromised package, potentially leading to full compromise of the application environment and downstream consumers.

No official patch or remediation is currently documented. Users should avoid using version 0.4.1 of @syncraft-labs/react and verify the integrity of package artifacts before use. Monitor vendor advisories or trusted sources for updates or official fixes. Given the nature of the attack, replacing the package with a clean, verified version or alternative is recommended until a fix is available.