GCVE-110-OSM-2026-10227

This package is a confirmed credential-harvesting stealer. The entrypoint index.js, triggered via both preinstall and postinstall hooks, performs multi-stage credential theft: it reads SSH private keys (~/.ssh/id_rsa, ~/.ssh/id_ed25519), AWS credentials, kubeconfig, .npmrc, .gitconfig, GCloud application credentials, Solana/Anchor/Sui keystores, Foundry keystores, and .env files from the working directory. It also captures environment variables matching a broad regex covering tokens, secrets, mnemonics, and API keys. The stolen data is serialized and exfiltrated to a hardcoded webhook.site endpoint via a detached child process spawned with stdio:'ignore' that delays 60–240 seconds to evade install-time scanners. The package includes active sandbox evasion (hostname/username/environment checks for honeypot indicators) and the publisher account mssjeep843 has already had two other packages (@aerodrome-finance/contracts, @aerodrome-finance/slipstream) confirmed malicious, indicating a deliberate campaign targeting DeFi/Web3 developers. ENTRY index.js (install-hook: node index.js || true) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json EXFIL - Environment Variable Exfiltration in index.js: "JSON.stringify(process.env)" - Sensitive File Access in index.js: "'.ssh/id_rsa'" - OAST/Interactsh Exfiltration in index.js: "webhook.site" - Git Configuration Access in index.js: ".gitconfig" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn(process.execPath, ['-e', src], { detached: true, stdio: 'ignore' }" - Shell Command Execution in index.js: "require('child_process')" - Silent Process Execution in index.js: "stdio: 'ignore'" - Detached Child Process Payload in index.js: "spawn(process.execPath, ['-e', src], { detached: true" - Brand New Package - Very New NPM Publisher Account (+1 more) PAYLOAD FILES index.js