Blockchain-based C2 loader campaign that injects payload code into production JS bundles of legitimate npm packages. Uses a three-layer blockchain dead-drop resolver: Tron smart contract stores encrypted C2 URL, BSC transaction carries XOR-encrypted payload, Aptos used for additional staging. Payload executes at require/import time as a side-effect, not via install hooks. Shared infrastructure across multiple compromised packages including astro.config.mjs and @joyfill scope.
Objective
Deliver arbitrary JavaScript payloads via blockchain-resolved C2 to downstream consumers of compromised npm packages.
