If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (fabc4baeb912d72d08ef42d8b6b5e147b1f7dc18fc01e796bc6ac17f1c7dff68)
devpack-conf@5.0.0 is a typosquat of pkg-conf. index.js contains a top-level eval(atob(...)) that decodes an obfuscated loader. The loader queries Ethereum RPC/blockscout endpoints for transactions from the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts an IPv4 address from the transaction's `to` field, fetches an XOR-encoded payload from http://<resolved-ip>:443/0x/cls and /0x/ls (XOR key delivered via the x-payload-b64 response header), eval()s the decrypted payload, and spawns a detached `node -e <payload>` child process with stdio:'ignore' and windowsHide:true. Sensitive strings (`http`, `https`, `child_process`, `spawn`, endpoint paths) are hidden behind \u unicode escapes. The malicious code executes automatically at require/import time on any consumer of the package.