The ESM build of @syncraft-labs/[email protected] includes a heavily obfuscated loader that uses rotating string arrays and opaque predicates to hide its functionality. It requires Node.js modules (http/https/zlib and child_process.spawn) to query Ethereum RPC endpoints and an Etherscan-style transaction list endpoint for a hardcoded Ethereum address. It extracts base64/gzip encoded payloads from blockchain transaction data and executes them via child_process.spawn, implementing a blockchain-hosted command and control dropper known as EtherHiding. The CommonJS build and sourcemap remain clean, indicating the ESM artifact was tampered with post-build to smuggle this malicious loader while preserving legitimate plugin functionality.

Any system importing the compromised ESM module of @syncraft-labs/[email protected] will execute attacker-controlled code fetched dynamically from the Ethereum blockchain, resulting in remote code execution on the host. This can lead to full system compromise, data theft, or further malicious activity. The attack vector is supply chain compromise via the npm package.

No official patch or remediation is currently documented. Users should avoid using @syncraft-labs/vue version 0.4.1, especially its ESM build. Verify package integrity before use and consider using the CommonJS build or alternative trusted packages. Monitor vendor advisories for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.