Malicious code in eth-react-provider (npm)

The npm package eth-react-provider was distributed with malicious code embedded in its built entry point (lib/index.js). While the package advertised itself as a React Ethereum provider with standard hooks (EthereumProvider, useProvider, useSigner, useNetwork), the actual shipped code contained web3.js Subscriptions code plus a large obfuscated payload.

The malicious payload was wrapped in a Function constructor and invoked automatically at module load time. The obfuscation employed randomized hex-named identifiers, a signed-integer decode table, and doubly-unicode-escaped strings to hide its true behavior from static inspection tools.

The discrepancy between the clean source code (src/index.js) and the trojanized built artifact (lib/index.js) indicates the built distribution was deliberately tampered with, consistent with a compromised or malicious build process rather than a legitimate release error.

Any consumer that required or imported eth-react-provider would execute this opaque code in their process, potentially during installation or at runtime, creating a supply chain risk for all downstream users and applications.