GCVE-110-OSM-2026-10138

Malicious npm package that installs a persistent, cross-platform Node.js backdoor and information stealer. It enables arbitrary command execution, credential and browser-password theft, cryptocurrency-wallet discovery, filesystem collection, keyboard and clipboard surveillance, data exfiltration, persistence, self-removal, and attacker-controlled payload replacement. The obfuscated JavaScript first installs Axios and Socket.IO Client in the operating-system temporary directory. It requests an encrypted second stage from the dropper endpoint recorded in verified_iocs. The response is split into a base64-encoded IV and ciphertext, decrypted using AES-256-CBC with a 32-byte scrypt-derived key, and written as `pack` in the temporary directory. It immediately executes that file using `node pack`. A separate embedded loader creates a local `main.js` and `package.json`, installs dependencies including Axios, better-sqlite3, node-machine-id, and socket.io-client, and launches the program as a detached process. That embedded loader requests another stage from the C2 endpoint recorded in verified_iocs, reads JavaScript from the response's `data.sessions` property, compiles it with `new Function`, and executes it in memory with access to `require`, `module`, `exports`, `__dirname`, and `__filename`. Errors from downloading, decryption, dependency installation, and execution are deliberately suppressed. No visible layer establishes a Socket.IO connection, although the dependency is installed for use by a later stage.