GCVE-110-OSM-2026-10739

The package advertises itself as a React Ethereum provider exporting EthereumProvider/useProvider/useSigner/useNetwork hooks, but the shipped main entry lib/index.js contains web3.js Subscriptions code plus a large obfuscated payload wrapped in a Function("ObbvO95", "...") constructor that is invoked at module load. The payload uses randomized hex-named identifiers, a signed-integer decode table, and a doubly-unicode-escaped string body to hide its behavior from static inspection. Any consumer that require('eth-react-provider') executes this opaque code in the installer's process. The src/index.js in the tarball contains the clean web3.js source without this payload, indicating the built artifact was tampered. The README/code mismatch (documented React hook API vs. actual web3.js Subscriptions plus loader) is consistent with a trojanized lookalike package rather than a broken release. Judge assessment: This looks like a trojanized lookalike package: the claimed React Ethereum provider API is contradicted by the shipped main entrypoint, which is `lib/index.js`, not a normal hook-based React module. The entry file contains an immediately invoked `Function("ObbvO95", "...")` wrapper with heavy unicode/hex string obfuscation, and the package only has one version from a brand-new publisher, a pattern consistent with a deceptive supply-chain drop. The attacker model is a typosquatted npm package intended to execute opaque code in the consumer's process on `require('eth-react-provider')`, hiding its true behavior from static inspection. The OSV advisory MAL-2026-14300 is corroborated by the actual `lib/index.js` contents and the README/code mismatch, so this should be treated as malicious. ENTRY lib/index.js (main: lib/index.js) OBFUSCATION - Obfuscation (osm-deobfuscator): unknown in lib/index.js - Obfuscation patterns: unicodeHeavy, hexHeavy in lib/index.js