The @wizloft/harness-plugin-repository-files npm package version 0.1.1-alpha.3 includes a small legitimate plugin followed by a ~35KB obfuscated payload using control-flow flattening and string rotation. The payload contains Ethereum JSON-RPC and block-explorer endpoints, a hardcoded Ethereum address, forged Chrome User-Agent strings, and uses Brotli/gzip decompression and AbortController-based fetch for network communication. It exfiltrates data via a custom /0x/ls path with x-payload-* headers. This malicious code executes immediately when the module is imported, unrelated to the package's stated purpose of reading repository files for harness runtime.

This malicious payload can cause unauthorized data exfiltration from any environment importing this package version. It may leak sensitive information to external Ethereum-related endpoints controlled by the attacker. The presence of obfuscation and network communication indicates an intent to evade detection and maintain persistence. No known exploits in the wild have been reported yet.

Users should avoid using @wizloft/harness-plugin-repository-files version 0.1.1-alpha.3. Since no patch or remediation is currently documented, the safest action is to remove this package from projects and replace it with a trusted alternative. Monitor vendor advisories for updates or official fixes. Validate dependencies before inclusion to prevent supply chain compromise.