envpack-conf version 1.0.1 is a trojanized npm package impersonating the legitimate pkg-conf utility. It contains malicious code that, when imported, asynchronously queries multiple public Ethereum RPC endpoints for transactions from a specific attacker address. It decodes transaction data to retrieve two IPv4 addresses, fetches an XOR-encrypted second-stage payload from these hosts, decrypts it, and executes it both via eval() and a detached Node.js child process. The package uses obfuscation techniques such as Unicode escapes and typosquatting to evade detection and impersonate the original maintainer.