A fake take-home that told you to install first

Summary

Audited branch original (tracks antfarm-original/main) as a static-only review. Known Antfarm / fake take-home supply-chain trap. Install or npm run dev is enough to trigger the chain. Do not install, run, or Phase-2 sandbox this tree.

Assignment context

Presented as “Proof of Dev” — on-chain developer reputation (Next.js, wallet/RainbowKit, Alchemy/Etherscan, scoring worker, optional NFT/EAS). README tells candidates to npm install && npm run dev.

Packages

Lockfile has 1251 packages (lockfileVersion 3). Transitives are lockfile-verified for the malware path. Remaining ~1200 packages were not fully reputation-scored (Sonatype unavailable). The malware path alone is decisive.

Unusual dependencies

• animatecss-tailwind-adapter@2.0.6 — SUSPICIOUS. Wired in apps/web/tailwind.config.ts via require('animatecss-tailwind-adapter')(...). Unrelated to wallet-reputation scoring.
• @aaron205whitmore/postcss-animate-utils@1.0.2 — SUSPICIOUS / malware. Unexpected private scope; only installable with the attacker .npmrc token.
• @x402/* — ESTABLISHED BUT NICHE for this take-home; not the blocking finding.

Typosquat / package confusion

Our static analysis found: decoy resembles legitimate Animate.css / Tailwind plugin ecosystems; private scope @aaron205whitmore looks like a personal/org package used for package-confusion / gated malware. Sonatype typosquat intel: not verified (MCP unavailable).

Git hooks / editor auto-run

• .git/hooks/: only *.sample — none found (non-sample)
• Global core.hooksPath / init.templateDir: empty
• .vscode / .devcontainer / .idea auto-run: none found

Risk is npm install / dev, not Git hooks or IDE folderOpen tasks.

Lifecycle scripts

No preinstall / install / postinstall / prepare on the malware packages in the lockfile (hasInstallScript absent). Payload is import-time / Tailwind-plugin evaluation — still RCE on a normal CSS build.

Hidden code that would have run

CRITICAL (our static analysis found; also confirmed from a disclosure-sample config.js matching this lockfile version):

• Obfuscated themeService base64 slice/reorder → host 153.75.81.2:1224
• fetch POST to /debugCheck
• Buffer.from(..., 'base64') on response message
• new Function('require', dynamicCssRules)(require) → Node RCE

App-local child_process in monorepo launchers and tests is expected for this assignment shape — not the C2 chain.

Network / remote execution

• C2: http://153.75.81.2:1224/debugCheck (raw IP HTTP)
• Registry: https://registry.npmjs.org/ for both malware tarballs
• Legitimate app endpoints (Alchemy, Etherscan, WalletConnect, localhost worker) in .env.example — not the block reason

Do not fetch the C2 payload.

Credentials / secrets

Values redacted. Never reuse this npm token.

Git history findings

• .npmrc with registry auth token introduced in 3c6624c (“feat(web): bootstrap Next.js app and Tailwind setup”).
• animatecss-tailwind-adapter present historically in apps/web devDependencies from that era.
• Current HEAD still contains .npmrc + malware deps (live trap branch, not a cleaned disclosure archive).

Sonatype findings

not verified / unavailable — Sonatype MCP namespace in error state; auth timed out. No CVE/trust scores claimed.

Opsera findings

not verified / incomplete — Opsera authenticated; secrets scan requires gitleaks, which was missing on the audit host. Static findings above stand independently.

Static analysis findings

1. Confirmed Antfarm-style chain before any install: obscure animation devDep → private scoped dep → malicious JS → hardcoded IP HTTP → base64 → new Function.
2. Attacker .npmrc present so install can fetch the restricted package.
3. Lockfile pins exact malware versions and integrity hashes.
4. tailwind.config.ts actively requires the decoy plugin.
5. No IDE folderOpen auto-exec; hooks clean.
6. apps/web/.next artifacts exist; node_modules was absent — do not install to “finish” a prior build.
7. Current branch original is the malicious assignment. Report reflects that HEAD.

Suspicious addresses

• domains: registry.npmjs.org (malware tarball host); C2 is IP-based
• IPs: 153.75.81.2
• URLs: http://153.75.81.2:1224/debugCheck; https://registry.npmjs.org/animatecss-tailwind-adapter/-/animatecss-tailwind-adapter-2.0.6.tgz; https://registry.npmjs.org/@aaron205whitmore/postcss-animate-utils/-/postcss-animate-utils-1.0.2.tgz
• filenames: .npmrc; apps/web/tailwind.config.ts; lockfile entries for the two packages
• hook hashes: none (no non-sample hooks)
• packages: animatecss-tailwind-adapter@2.0.6; @aaron205whitmore/postcss-animate-utils@1.0.2
• integrity: sha512-xUYmRvcpcrc2Q5VT6muogMpOmHsXRdNo/cd87vXrZA0hziavzvHlJu9s6BRvP1/5yUa3mU8yJXFEiddLwLGDyw== (decoy); sha512-XRkEgb9Rl0n3qx5ozUpVxqTzZLcqfePskFeAgjBlQanPj9Ncn8iEU6FKUFiOL3XKjL9/cDyfJUgvjfcr123zAg== (dropper)
• commits / refs: 3c6624c (.npmrc + bootstrap); branch original / remote antfarm-original/main

Limitations

• No install-time or runtime behavior observed (by design).
• Sonatype reputation/CVE graph not verified.
• Opsera gitleaks secrets scan not completed.
• Full transitive reputation review of ~1250 packages not performed; malware path alone is decisive.
• Dropper source corroborated via lockfile identity and prior static read of the same version’s config.js / published campaign docs; package tarball was not re-fetched.