GCVE-110-OSM-2026-10351

This looks like a credential-stealing and persistence payload disguised as a streak-math library, with a plausible attacker model of a supply-chain compromise targeting npm consumers. The entrypoint in `dist/index.mjs` launches `dist/internal/calc-map.bin` as a detached child process, and that binary is packed with browser-login theft, cookie theft, cron persistence, and `.bashrc` startup modification patterns. The recovered IOCs include a hardcoded C2 IP plus `litterbox.catbox.moe` and `ipify.org`, which fits exfiltration and host fingerprinting rather than a legitimate cache helper. The package is also a brand-new publisher account with a single version, and the claimed integrity check in `index.mjs` does not mitigate the malicious behavior because the scanned binary itself contains the attacker logic. ENTRY dist/index.mjs (main: ./dist/index.mjs) LOOT - Browser Data Theft in dist/internal/calc-map.bin: "firefox/*/logins.json; do [ -f "$p" ] || continue; PR=$(basename $(dirname "$p")..." PERSISTENCE - Cron Job Persistence in dist/internal/calc-map.bin: "crontab -" - Startup Persistence in dist/internal/calc-map.bin: ".bashrc" DESTINATION - 6 c2 (ipv4, urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Chai-Max Browser Data Theft in dist/internal/calc-map.bin: "BraveSoftware/Brave-Browser microsoft-edge; do for p in ~/.config/$b/*/Login" - Binary: Credential Theft in dist/internal/calc-map.bin: "N=0; for b in google-chrome chromium BraveSoftware/Brave-Browser microsoft-edge;..." - Detached Child Process Payload in dist/index.mjs: "spawn(binaryPath, [], { stdio: 'pipe', shell: false, detached: true" - Very New NPM Publisher Account - Binary: Shell in dist/internal/calc-map.bin: "/bin/sh" - Binary: Network IOCs Detected in dist/internal/calc-map.bin: "http://%s:%d/Others/%s" PAYLOAD FILES dist/internal/calc-map.bin