@syncraft-labs/react

Details

**Severity:** Critical

**Affected versions:** `= 0.4.1`

## Source: amazon-inspector (c3986bd05347035d9263c22b871840f19dc42187d3e1719311cb67c6e1ef5cb9)
dist/index.js (the ESM entry resolved by default by modern bundlers such as Vite, Next.js, and Webpack) contains a heavily obfuscated block using obfuscator.io-style identifiers, a rotated ~300-entry string array, and a decoder wrapper injected inside the useEffect body of the useSync hook. The block captures globalThis.r=require and globalThis.m=module, then uses http/https and zlib (createInflate/createBrotli) to fetch data from Ethereum RPC endpoints (h.drpc.org, 1rpc.io/eth), Blockscout, and Etherscan for a hardcoded contract address (0xa322E5f3...), reconstructs code from the on-chain bytes, and executes it with require access. This is the EtherHiding pattern: the on-chain contract is mutable, so operators of that contract can deliver arbitrary JavaScript to any consumer that renders a component using useSync, achieving remote code execution in Node build/SSR contexts and in the browser bundle of downstream applications. The obfuscated blob is absent from dist/index.cjs and from the TypeScript sources referenced by dist/index.js.map, indicating the ESM artifact was tampered after build.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/51911d234a84078e05bdf54c4b86161625e68d64/osv/malicious/npm/@syncraft-labs/react/MAL-2026-14368.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/51911d234a84078e05bdf54c4b86161625e68d64/osv/malicious/npm/@syncraft-labs/react/MAL-2026-14368.json
- https://www.npmjs.com/package/@syncraft-labs/react/v/0.4.1
- https://github.com/advisories/GHSA-83j7-x5xf-qxwq

Compromised versions (1)

• = 0.4.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.