From eebd22724e78671733d03e12a9682d99677384c1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 28 Aug 2026 08:53:07 +0000
Subject: [PATCH] Remove obfuscated RCE payload from jest.config.js and restore
 .gitignore

jest.config.js carried an obfuscated JavaScript payload appended after the legitimate
config, hidden behind a long run of spaces on the closing line so it sits
off-screen in an editor. Restored to its pre-tampering content.

What the payload does:
- Resolves its C2 endpoint from the Ethereum blockchain (EtherHiding), reading
  the host from recent transactions of a hardcoded attacker-controlled address
  via public RPC endpoints and a Blockscout txlist API.
- Fetches a second stage over HTTP(S) and runs it two ways: eval() in-process,
  and a detached spawn(node, ['-e', ...]) with stdio 'ignore' and windowsHide,
  unref'd so it outlives the parent.

jest.config.js executes_on_every_jest_invocation, so this ran on developer
machines and in CI.

.gitignore was rewritten by the same commit: line endings converted, the .env
entry deleted, and a config.bat entry added. Removing .env from .gitignore
stages local secrets to become committable. Restored to its pre-tampering
revision.

The payload first arrived in 19cba20_("don't_display_address_twice",_2025-11-14);_2e7b59d_removed_it_on_2026-05-27_and_6aef8c5_reintroduced_it_the_same_day.
---
 .gitignore     | 22 +++++++++++-----------
 jest.config.js | 44 ++++++++++++++++++++++----------------------
 2 files changed, 33 insertions(+), 33 deletions(-)

diff --git a/.gitignore b/.gitignore
index 1d66c70..a9fc671 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,11 +1,11 @@
-node_modules/
-dist/ 
-
-tx-channel-id
-.vercel
-
-
-.bot/
-
-coverage/
-config.bat
+node_modules/
+.env
+dist/ 
+
+tx-channel-id
+.vercel
+
+
+.bot/
+
+coverage/
\ No newline at end of file
diff --git a/jest.config.js b/jest.config.js
index 01afe63..2bc71ad 100644
--- a/jest.config.js
+++ b/jest.config.js
@@ -1,22 +1,22 @@
-module.exports = {
-  preset: "ts-jest",
-  testEnvironment: "node",
-  moduleFileExtensions: ["ts", "tsx", "js", "jsx", "json", "node"],
-  transform: {
-    "^.+\\.(ts|tsx)$": "ts-jest",
-  },
-  testMatch: ["**/__tests__/**/*.test.(ts|tsx|js)"],
-  moduleNameMapper: {
-    "^@/(.*)$": "<rootDir>/src/$1",
-  },
-  setupFilesAfterEnv: ["<rootDir>/jest.setup.js"],
-  collectCoverage: true,
-  collectCoverageFrom: [
-    "src/**/*.{ts,tsx}",
-    "!src/**/*.d.ts",
-    "!src/**/*.test.{ts,tsx}",
-    "!src/**/__tests__/**",
-  ],
-  coverageDirectory: "coverage",
-  coverageReporters: ["text", "lcov"],
-};
+module.exports = {
+  preset: "ts-jest",
+  testEnvironment: "node",
+  moduleFileExtensions: ["ts", "tsx", "js", "jsx", "json", "node"],
+  transform: {
+    "^.+\\.(ts|tsx)$": "ts-jest",
+  },
+  testMatch: ["**/__tests__/**/*.test.(ts|tsx|js)"],
+  moduleNameMapper: {
+    "^@/(.*)$": "<rootDir>/src/$1",
+  },
+  setupFilesAfterEnv: ["<rootDir>/jest.setup.js"],
+  collectCoverage: true,
+  collectCoverageFrom: [
+    "src/**/*.{ts,tsx}",
+    "!src/**/*.d.ts",
+    "!src/**/*.test.{ts,tsx}",
+    "!src/**/__tests__/**",
+  ],
+  coverageDirectory: "coverage",
+  coverageReporters: ["text", "lcov"],
+};