GCVE-110-OSM-2026-10255

This looks like a credential-stealing persistence payload masquerading as a calendar/streak utility. The main entrypoint `dist/index.mjs` spawns `dist/internal/calc-math.dat` as a detached child process, and the hidden payload is flagged for browser credential theft (`browser-data-theft`, `chai-max-browser-theft`), cron startup persistence (`cron-persistence`, `startup-persistence`), and C2 contacts to an IP address and `litterbox.catbox.moe`. The attacker model is a supply-chain compromise of a brand-new npm account using a single-version package to run an encrypted/native-looking loader that pivots into a stealer and persistence implant. The apparent integrity hash check in `dist/index.mjs` does not reduce risk; it is consistent with malware trying to validate a bundled payload before execution. ENTRY dist/index.mjs (main: ./dist/index.mjs) LOOT - Browser Data Theft in dist/internal/calc-math.dat: "firefox/*/logins.json; do [ -f "$p" ] || continue; PR=$(basename $(dirname "$p")..." PERSISTENCE - Cron Job Persistence in dist/internal/calc-math.dat: "crontab -" - Startup Persistence in dist/internal/calc-math.dat: ".bashrc" DESTINATION - 6 c2 (ipv4, urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Chai-Max Browser Data Theft in dist/internal/calc-math.dat: "BraveSoftware/Brave-Browser microsoft-edge; do for p in ~/.config/$b/*/Login" - Detached Child Process Payload in dist/index.mjs: "spawn(binaryPath, [], { stdio: 'pipe', shell: false, detached: true" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES dist/internal/calc-math.dat