The malicious code in @wizloft/harness-kernel (version 0.1.1-alpha.3) includes an obfuscated asynchronous immediately-invoked function expression (IIFE) that runs upon module import. It queries Ethereum JSON-RPC endpoints for the latest transaction from a hardcoded address, extracting two IPv4 addresses from the transaction's 'to' field. It then fetches XOR-encrypted payloads from HTTP endpoints at these IPs, decrypts them, and executes the resulting JavaScript code via eval and a detached Node.js process. The obfuscation techniques conceal the network fetch and execution chain behind benign exports. The on-chain command and control mechanism allows the attacker to change the payload delivery endpoints dynamically, making mitigation and takedown challenging. The payloads are attacker-controlled and their contents are not disclosed.

This malicious package enables remote code execution on any system that imports the affected version, potentially allowing attackers to run arbitrary code. The dynamic retrieval of payloads from attacker-controlled infrastructure and the use of blockchain-based command and control increase the difficulty of detection and remediation. This can lead to system compromise, data exfiltration, or further malware deployment.

No official patch or remediation is currently available for this malicious package version. Users should immediately remove and avoid using @wizloft/harness-kernel version 0.1.1-alpha.3. Verify the integrity of dependencies and use trusted sources. Monitor for any suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.