Ongoing NPM attack adminide-stack tab-padded eval(atob) with an ETH dead-drop

Greenflagged reports an ongoing npm compromise: on 2026-11-03 the account clockbook-app published malicious versions of @adminide-stack packages and server-hemera-mongo, each appending a tab-padded eval(atob(...)) loader to the entry file. The script reads an Ethereum wallet's latest transaction, derives a C2 IPv4 address from it, and fetches the next stage. Plain installs of utils and client-redux now resolve to bad versions. The analysis was static; stage 2 was not examined. The figures come from Greenflagged alone, with no independent source cited.