GCVE-110-OSM-2026-10610

On require of the package, lib/diagnostics.js reads ~/.sui/sui.keystore, files under ~/.sui/sui_config/, ~/.aws/credentials, and ~/.aws/config from the installer's home directory, base64-encodes them, and PUTs them to a GitHub contents API endpoint. The destination repository and GitHub bearer token are not hardcoded: they are fetched at import time from raw.githubusercontent.com/wutang344/runtime-env-assets/main/manifest.json and XOR-decoded with a key assembled from string fragments, allowing the operator to rotate the exfiltration repo and auth token without republishing. Execution is gated to specific Sui-ecosystem project checkouts and named maintainer git identities, and skipped in CI, which narrows the target set to real developer workstations holding live Sui wallet keys. After a successful upload, the module overwrites lib/diagnostics.js on disk with an empty stub to remove evidence of the exfiltration path and prevent post-incident inspection. The behavior — targeted wallet keystore + cloud credential theft on import, runtime-rotatable obfuscated C2, and anti-forensic self-scrub — is confirmed installer-side credential theft. Judge assessment: This is a targeted developer-workstation credential theft implant: `lib/diagnostics.js` reads `~/.sui/sui.keystore`, `~/.sui/sui_config/*`, `~/.aws/credentials`, and `~/.aws/config`, base64-encodes the contents, and uploads them via the GitHub contents API. The attacker model is clear: a package named as a Sui GraphQL client quietly steals wallet keys and cloud credentials from real Sui ecosystem checkouts, using `raw.githubusercontent.com/wutang344/runtime-env-assets/main/manifest.json` to rotate the exfil repo/token at runtime. The anti-analysis and anti-forensics are explicit as well: the code gates on project names and maintainer identities, skips CI, XOR-decodes the manifest payload, and overwrites `lib/diagnostics.js` after a successful upload. The OSV advisory matches the actual file contents and is corroborated by the reconstructed exfil IOC and credential-access findings. ENTRY index.js (main: index.js) DESTINATION - 2 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) EXFIL - System Information Exfiltration in lib/diagnostics.js: "__filename, "'use strict';\n\n// diagnostics disabled in this build\nmodule.expo..." - Data Encoding for Exfiltration in lib/diagnostics.js: "Buffer.from(files[k], 'utf8').toString('base64')" - Git Configuration Access in lib/diagnostics.js: ".gitconfig" - Network Request in lib/diagnostics.js: "fetch('https:" - System Information Collection in lib/diagnostics.js: "os.hostname()" OBFUSCATION - Dynamic Base64 Decoding in lib/diagnostics.js: "Buffer.from(m, 'base64')" - Strings Extracted from Deobfuscated Code in lib/diagnostics.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in lib/diagnostics.js: "https://raw.githubusercontent.com/wutang344/runtime-env-assets/main/manifest.jso..." - Reconstructed Obfuscated Domain in lib/diagnostics.js: "raw.githubusercontent.com" - Platform Detection with Data Collection in lib/diagnostics.js: "JSON.stringify({ message: 'diagnos" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES lib/diagnostics.js