GCVE-110-OSM-2026-10223

The package contains a Sui wallet credential stealer. Its payload communicates with GitHub’s REST API and exfiltrates data into this repository: futongwan/sui-research-notes. It writes to the reports branch using the commit message add environment fingerprint. What it steals: - ~/.sui/sui.keystore - ~/.sui/sui_config/client.yaml - ~/.sui/sui_config/sui_config.yaml - .env* files in the current directory and home directory, provided they contain SUI_, PK_B64, or PRIVATE_KEY - Host metadata: Node version, OS/platform, current working directory, timestamp ENTRY index.js (main: index.js) EXFIL - Important behavioural details: - It only activates when ~/.sui/sui.keystore exists. - It avoids CI and GitHub Actions environments. - It uses a four-second request timeout and suppresses all errors. - After running—or attempting to run—it rewrites its own index.js to remove everything between the compat-probe markers. This is an anti-forensics/self-deletion mechanism. - It embeds a 40-character classic GitHub personal access token beginning with ghp_. I have intentionally not reproduced it. Its SHA-256 is: 60d64b0524d5bf9789d80d03134a360fa6eb7e24d45ffc14653126499c477faa PAYLOAD FILES index.js