Malicious code in @wizloft/harness-context (npm)

The npm package @wizloft/harness-context was found to contain malicious code in its main entry point (dist/index.js). The malicious payload is an obfuscated IIFE appended after legitimate context-service code, using obfuscator.io-style obfuscation with a rotated string decoder array (~303 entries) to hide its true behavior.\n\nOn import, the payload stashes references to require and module in global variables, then makes HTTPS requests to an Ethereum public RPC endpoint (h.drpc.org) and a block-explorer account API. It reads state from a smart contract (0xa322E5f3...) to resolve a next-stage URL, which is then fetched and executed in-process. This implements the EtherHiding loader pattern, allowing the attacker to update malicious code by modifying contract state without republishing the package.\n\nThe obfuscated strings hide indicators including drpc.org, ?module=ac, POST, application/json, Mozilla/5., and the contract address. The package's advertised purpose—a small typed capability contract—does not match its actual behavior.\n\nThe incident was identified by the OpenSSF malicious-packages project and reported via Amazon Inspector.