@rentwise/common
This report shows the evidence for @rentwise/common@1.0.36. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-12328 confirms this npm version as malicious.
Advisory
MAL-2026-12328
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @rentwise/common (npm)
Details
build/index.js appends an eval(atob(...)) blob to the legitimate common-library exports, so the payload runs whenever any consumer require()s @rentwise/common. The decoded payload queries public Ethereum JSON-RPC nodes and eth.blockscout.com/api to fetch the latest transaction sent by the hardcoded wallet 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, reconstructs an IPv4 address from the transaction's tx.to field (bytes 0-3 as octets), then HTTP GETs http://<ip>:443/0x/cls and http://<ip>:443/0x/ls. The response body is XOR-decoded using the x-payload-b64 header, eval()'d in-process, and additionally spawned as a detached `node -e <payload>` child process with stdio:ignore and windowsHide. All strings (module names http/https/zlib/child_process, URLs, RPC method names) are \uXXXX-escaped inside the base64 blob to defeat static string matching. The blockchain-anchored C2 (EtherHiding pattern) lets the operator rotate infrastructure by broadcasting a new on-chain transaction. This grants arbitrary remote code execution on any host that installs and loads the package.
References
Independent scan evidence
public snapshotBehavioral surface
EnvironmentVarsEval
HighEntropyStrings
Source & flagged code
2 flagged · loading sourcebuild/index.jsView file
37__exportStar(require("./events/types/verification-status"), exports);
L38: __exportStar(require("./events/expiration-verification-events"), exports); ...
Low
Eval
Package source references a known benign dynamic code generation pattern.
build/index.jsView on unpkg · L37build/index.js#virtual:base64:round1View file
1global.i="A8-###";global.r=require;typeof module==="object"&&(global.m=module);const http=require("\u0068\u0074\u0074\u0070"),https=require("\u0068\u0074\u0074\u0070\u0073"),zlib=r...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
build/index.js#virtual:base64:round1View on unpkg · L1Findings
1 High1 Medium3 Low
HighSame File Env Network Executionbuild/index.js#virtual:base64:round1
MediumEnvironment Vars
LowScripts Present
LowEvalbuild/index.js
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @rentwise/common@1.0.36.
The versions list below shows the verdict for each recorded version.
- Avoid installing @rentwise/common@1.0.36. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.