GCVE-110-OSM-2026-10352

This package matches a credential-stealing and persistence attacker model, not a benign date-math library: the embedded payload in dist/internal/calc-math.dat contains browser credential collection, cron startup edits, and external C2 endpoints. The code in dist/index.mjs launches that binary via detached child_process.spawn with suppressed I/O, which is consistent with stealthy payload execution after install or import. The recovered IOCs include a hard coded IP, custom domain, and the URLs http://%s:%d/Others/%s and http://%s:%d/SC/%s, while the rule chai-max-browser-theft explicitly aligns with known malware behavior. Given the combination of credential theft, persistence, and C2, this should be treated as a compromised package and submitted to OSM as malicious. ENTRY dist/index.mjs (main: ./dist/index.mjs) LOOT - Browser Data Theft in dist/internal/calc-math.dat: "firefox/*/logins.json; do [ -f "$p" ] || continue; PR=$(basename $(dirname "$p")..." PERSISTENCE - Cron Job Persistence in dist/internal/calc-math.dat: "crontab -" - Startup Persistence in dist/internal/calc-math.dat: ".bashrc" DESTINATION - 6 c2 (ipv4, urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Chai-Max Browser Data Theft in dist/internal/calc-math.dat: "BraveSoftware/Brave-Browser microsoft-edge; do for p in ~/.config/$b/*/Login" - Detached Child Process Payload in dist/index.mjs: "spawn(binaryPath, [], { stdio: 'pipe', shell: false, detached: true" - Brand New Package PAYLOAD FILES dist/internal/calc-math.dat