bin/install/install.js appends an obfuscated blob after the module exports, hidden behind whitespace padding, which runs on module load whenever the anhn bin is invoked. It reads an Ethereum dead-drop address through public RPC and explorer APIs, decodes the transaction recipient bytes into a command-and-control address, then retrieves a stage-two payload from a base64 response header and XOR-decodes it with a hardcoded key. The payload is executed twice: via eval() and via a detached child node -e process that survives the parent. Versions 1.1.0-1.1.3 (published 2020-12-06) do not contain this code; 1.1.4 was published 2026-08-19 after 5.7 years of dormancy.