@syncraft-labs/react@0.4.1

dist/index.js (the ESM entry resolved by default by modern bundlers such as Vite, Next.js, and Webpack) contains a heavily obfuscated block using obfuscator.io-style identifiers, a rotated ~300-entry string array, and a decoder wrapper injected inside the useEffect body of the useSync hook. The block captures globalThis.r=require and globalThis.m=module, then uses http/https and zlib (createInflate/createBrotli) to fetch data from Ethereum RPC endpoints (h.drpc.org, 1rpc.io/eth), Blockscout, and Etherscan for a hardcoded contract address (0xa322E5f3...), reconstructs code from the on-chain bytes, and executes it with require access. This is the EtherHiding pattern: the on-chain contract is mutable, so operators of that contract can deliver arbitrary JavaScript to any consumer that renders a component using useSync, achieving remote code execution in Node build/SSR contexts and in the browser bundle of downstream applications. The obfuscated blob is absent from dist/index.cjs and from the TypeScript sources referenced by dist/index.js.map, indicating the ESM artifact was tampered after build.