GCVE-110-OSM-2024-160

Malicious Go module 'github.com/erbieio/erbie' compromised in the Miasma / Mini Shai-Hulud supply-chain worm campaign (Socket). The affected version(s) were published with a worm payload that steals developer credentials and self-propagates to other packages and repositories belonging to the compromised maintainer. Part of the Miasma / 'Mini Shai-Hulud' self-propagating supply-chain worm (Socket threat research). Behavior: a malicious install hook (npm postinstall / equivalent) executes a large obfuscated bundle (setup.js ~4.6MB) that harvests developer secrets — npm and GitHub tokens, cloud credentials, and environment variables — via secret-scanning, then exfiltrates them to attacker-controlled infrastructure. Worm propagation: using stolen npm/GitHub credentials, the payload republishes itself into the maintainer's other packages and injects itself into their repositories (package.json install hooks, .claude/settings.json, and similar), spreading across the victim's portfolio without operator interaction. Verdict from repository forensics: high_confidence_malicious.