GCVE-110-OSM-2026-10256

This looks like a credential/exfiltration loader masquerading as a dotenv utility: the entrypoint in lib/main.js contains hidden C2 targets recovered by deobfuscation, including www.dotenvx.com and www.vestauth.com, plus the plaintext IP. The code combines dynamic execution (`exec(lines)`), base64-decoded content (`Buffer.from(encrypted, 'base64')`), system fingerprinting (`os.homedir()`, `os.hostname()`, `os.platform()`), and POST requests in lib/tui-options.js, which is consistent with a loader stealing host data and shipping it to attacker-controlled infrastructure. The attacker model is a supply-chain implant published from a brand-new npm account (`everdreamsoft2010`) under a typosquatted name (`safe-local-env-loader`) to harvest environment and system information from developers or CI runners. The recovered IOCs and obfuscated payload are not explainable as normal dotenv behavior, so this should be treated as confirmed malicious. ENTRY lib/main.js (main: lib/main.js) DESTINATION - 3 exfil (custom-c2) - 1 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - System Information Collection in lib/main.js: "os.homedir()" - Network Request in lib/tui-options.js: "request( { method: 'POST', protocol: parsedUrl.protocol, hostname: parsedUrl.hos..." - System Information Collection in lib/tui-options.js: "os.hostname()" OBFUSCATION - IOCs Found in Deobfuscated Code in lib/main.js - Dynamic Base64 Decoding in lib/main.js: "Buffer.from(encrypted, 'base64')" - recovered 3 domains, 2 emails, 3 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Dynamic Code Execution in lib/main.js: "exec(lines)" - Shell Command Execution in lib/tui-options.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES lib/main.js (+ lib/tui-options.js)