MSC-2026-11359

bin/install/install.js appends an obfuscated blob after the module exports, hidden behind whitespace padding, which runs on module load whenever the anhn bin is invoked. It reads an Ethereum dead-drop address through public RPC and explorer APIs, decodes the transaction recipient bytes into a...