The npm package iconova-react (versions 1.30.0 and 1.30.1) is a malicious re-hosted copy of lucide-react containing injected code in two icon modules. This code executes at import time, querying Ethereum blockchain data to retrieve IP addresses for fetching and executing attacker-controlled payloads, enabling arbitrary code execution on the host system. This is a deliberate supply-chain attack exploiting the package's impersonation of lucide-react.