GCVE-110-OSM-2026-10243

This is a confirmed supply-chain compromise of a legitimate package. Version 1.57.1 has been self-deprecated by the maintainer with an explicit backdoor warning. The `src/auth.js` file contains a trojanized payload hidden after `module.exports` behind hundreds of whitespace characters — classic trojanized-package concealment. The hidden code uses unicode-escaped require calls (`\u0068\u0074\u0074\u0070` → 'http', `\u0063\u0068\u0069\u006C\u0064\u005F\u0070\u0072\u006F\u0063\u0065\u0073\u0073` → 'child_process') to load modules without detection, sets `global['r']=require` and `global['_V']` (a confirmed PolinRider/DPRK-Lazarus campaign marker), and contacts Ethereum RPC endpoints (`https://eth.blockscout.com/api`, `https://1rpc.io/eth`, `https://eth.drpc.org`) decoded from unicode-escaped strings — consistent with crypto-wallet draining or blockchain-based C2. The payload also includes a hardcoded Ethereum address (`0xa322E5f3D311D3080e6f01210635e9aDC2490Ef1a`) and spawns child processes. The campaign-polinrider rule match plus the maintainer's own deprecation notice leave no ambiguity. ENTRY bin/kolbo-mcp.js (bin: ./bin/kolbo-mcp.js) PERSISTENCE - Startup Persistence in src/tools/projects.js: ".profile" DESTINATION - 53 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in src/client.js: "process.env.KOLBO_CALLER_SESSION_ID; if (callerSessionId) { headers['X-Kolbo-Cal..." - Data Encoding for Exfiltration in src/apps/index.js: "encodeURIComponent(avatar" - Data Encoding for Exfiltration in src/auth.js: "encodeURIComponent(client_id" - Data Encoding for Exfiltration in src/polling.js: "encodeURIComponent(generationId)}/status" - Data Encoding for Exfiltration in src/tools/_shared.js: "Buffer.from(ab).toString('base64')" - Data Encoding for Exfiltration in src/tools/agents.js: "encodeURIComponent(search" - Data Encoding for Exfiltration in src/tools/chat.js: "encodeURIComponent(session_id)}/messages${qs ? '?' + qs" - Data Encoding for Exfiltration in src/tools/color_palettes.js: "encodeURIComponent(`<svg xmlns="http://www.w3.org/2000/svg" width="${w}" height=..." (+14 more) OBFUSCATION - Decoded Unicode Escape Content in src/auth.js (x20) - IOCs Found in Deobfuscated Code in src/tools/media.js - Trailing Code After Module Exports in src/auth.js: "module.exports = { browserLogin }; g" - Whitespace-Padded Hidden Payload in src/auth.js: "; global" - Dynamic Base64 Decoding in src/auth.js: "Buffer.from(n,"base64")" - Dynamic Base64 Decoding in src/tools/media.js: "Buffer.from(source_base64, 'base64')" - Unicode Escape Obfuscation in src/auth.js: "\u0068\u0074\u0074\u0070\u0073" - Deobfuscation Failed in src/auth.js (+2 more) ADDITIONAL FINDINGS - Global Require Alias in src/auth.js: "global['r']=require" - Campaign marker: PolinRider in src/auth.js: "global['_V']" - Clipboard Access in src/apps/widgets/transcript.js: "navigator.clipboard.writeText" - Dynamic Code Execution in src/auth.js: "eval(r+" - Shell Command Execution in src/auth.js: "require('child_process')" - Platform Detection with Data Collection in src/tools/media.js: "JSON.stringify({ status: 'widget_unavailable', hint: 'This hos" PAYLOAD FILES src/auth.js