Malicious code in @wizloft/harness-plugin-repository-files (npm)

The npm package @wizloft/harness-plugin-repository-files was found to contain malicious code embedded in its dist/index.js file. The package ships a legitimate wizloft-harness repository-files plugin followed by approximately 35KB of obfuscated code packed with obfuscator.io, featuring control-flow flattening and a rotated string array decoder.\n\nThe obfuscated payload includes hardcoded Ethereum JSON-RPC and block-explorer endpoints (drpc.org, publicnode.com, blockscout), a mixed-case ETH address prefix (0xa322E5f3...), a forged Chrome User-Agent, and brotli/gzip decompression capabilities. The malicious code establishes communication via a custom /0x/ls exfiltration path with x-payload-* headers.\n\nThe payload executes automatically whenever the package is imported, running at module load time. The legitimate plugin code remains in plain ESM format, while only the trailing malicious segment is obfuscated, indicating a hostile payload was deliberately smuggled into an otherwise-clean plugin build.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository, which tracks confirmed supply chain compromises.