GCVE-110-OSM-2026-10350

This package is a credential-stealer masquerading as a streak computation utility. The entrypoint (dist/index.mjs) loads and executes a binary (dist/internal/map-calc.bin) as a detached, pipe-suppressed child process — a classic technique to silently run a payload that survives parent exit. The binary contains verbatim shell commands targeting Chrome, Brave, Edge, and Firefox credential stores (Login Data, Cookies, logins.json, key4.db), cron/bashrc persistence mechanisms, and C2 exfiltration endpoints including litterbox.catbox.moe (a file-upload service used for data exfil) and hardcoded IP 217.60.77.63. The 'integrity check' in the JS wrapper is cosmetic theater — it merely validates the malicious binary is unmodified. Patterns match the chai-max stealer family signature. The publisher account is brand new (< 1 day old) with no package history. ENTRY dist/index.mjs (main: ./dist/index.mjs) LOOT - Browser Data Theft in dist/internal/map-calc.bin: "firefox/*/logins.json; do [ -f "$p" ] || continue; PR=$(basename $(dirname "$p")..." PERSISTENCE - Cron Job Persistence in dist/internal/map-calc.bin: "crontab -" - Startup Persistence in dist/internal/map-calc.bin: ".bashrc" DESTINATION - 6 c2 (ipv4, urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Chai-Max Browser Data Theft in dist/internal/map-calc.bin: "BraveSoftware/Brave-Browser microsoft-edge; do for p in ~/.config/$b/*/Login" - Binary: Credential Theft in dist/internal/map-calc.bin: "N=0; for b in google-chrome chromium BraveSoftware/Brave-Browser microsoft-edge;..." - Detached Child Process Payload in dist/index.mjs: "spawn(binaryPath, [], { stdio: 'pipe', shell: false, detached: true" - Brand New Package - Very New NPM Publisher Account - Binary: Shell in dist/internal/map-calc.bin: "/bin/sh" (+1 more) PAYLOAD FILES dist/internal/map-calc.bin