XPACK Malware Disguises Cryptocurrency Extortion as NPM Package Monetization

XPACK is a coordinated malicious npm campaign that published multiple packages containing a preinstall hook which fingerprints the device, harvests GitHub identities, exfiltrates data to a Vercel-hosted C2, and enforces a crypto "payment required" (HTTP 402) paywall that blocks installation until a 0.1 USDC/ETH payment is made; the report provides technical analysis, IOCs (domains, wallet, package names, file hashes), timeline, and attribution to npm user dev.chandra_bose.