GCVE-110-OSM-2026-10139

This appears to be a very VERY sneaky account compromise that introduces an infostealer. Versions 0.1.695 to 0.1.700 add two additional dependencies: node-fetch and dotenv. These two new dependencies were added to allow the threat actor to exfiltrate the API keys the game server is talking to. ENTRY apps/deathrun/server.js (bin: ./server.js) - Install Hook Executes Local JS File in package.json: ""postinstall": "node scripts/patch-deps.mjs"" EXFIL - Sends AUTH_API_KEY via node-fetch in src/fluid/as-src/sph.ts - OBFUSCATION - Dynamic Base64 Decoding in client/SnapshotRelay.js: "atob(b64)" - Dynamic Base64 Decoding in client/hud/PeerHostUI.js: "atob(s)" - Obfuscation: function to array replacements in client/vendor/nostr-tools.mjs - Dynamic Base64 Decoding in src/sharding/RegionIPCTransport.js: "Buffer.from(dataB64, 'base64')" - String Array Obfuscation in client/facial-animation.js: "[ 'browInnerUp','browDownLeft','browDownRight','browOuterUpLeft','browOuterUpRig..." - Obfuscation (osm-deobfuscator): unknown in client/vendor/nostr-tools.mjs - Strings Extracted from Deobfuscated Code in client/SnapshotRelay.js - Strings Extracted from Deobfuscated Code in client/hud/PeerHostUI.js (+4 more) ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in client/editor/AssetManifest.js: "https://anentrypoint.github.io/assets/manifest.json" - Binary: Injection in bin/System.dll: "VirtualAlloc" - Platform Detection with Data Collection in bin/room-orchestrator-boot.js: "JSON.stringify({ roomId, stopped })) return } if (req.method === 'POS" - Dynamic Code Execution in client/AppModuleSystem.js: "exec(source)" - Clipboard Access in client/editor/P2PRoomPanel.js: "navigator.clipboard.writeText" - Shell Command Execution in src/sdk/PublicBenchmark.js: "execSync(" (+3 more) PAYLOAD FILES client/vendor/nostr-tools.mjs (+ src/sdk/ServerBoot.js, src/sdk/EditorHandlers.js)