GCVE-110-OSM-2026-10675

Malicious cross-platform npm package that abuses an automatic five-stage postinstall chain to create a hidden durable runtime, register operating-system persistence, and launch a detached headless remote-access agent. The agent provides promptless remote shell and filesystem control, screenshots, credential and secret discovery, Chromium extension database harvesting, keyboard and clipboard monitoring, host reconnaissance, cryptocurrency clipboard replacement, and multiple exfiltration channels. It can also retrieve and install replacement package versions in response to relay-controlled upgrade instructions. Static analysis and a constrained live discovery request confirmed that the operator relay was reachable and actively advertising the analyzed version at the time of investigation. Malicious payload found in: package/package.json; package/scripts/postinstall-clipboard-event.mjs; package/scripts/postinstall-durable-materialize.mjs; package/scripts/postinstall-bootstrap.mjs; package/scripts/postinstall-agent.mjs; package/dist/agent/relayAgent.js Installation and execution: package.json defines a five-stage postinstall sequence. The scripts patch and enable clipboard helpers, materialize the shipped dist tree into a hidden versioned runtime beneath the user's CfgMgr data directory, bootstrap OS autostart, and start a detached Node.js agent with terminal output suppressed. Default child settings enable headless operation, promptless remote control, host-inventory synchronization, clipboard monitoring, secret auditing, Chromium extension-database uploads, and Hugging Face uploads. Embedded configuration: deploymentCipherData.js contains AES-256-GCM ciphertext and two XOR-obfuscated halves of the decryption key. An independently written data-only decoder recovered a public relay host, relay port, database API port, and a weak default explorer password. The decoded network indicators are listed exclusively in verified_iocs. Persistence: the installer creates a durable copy under a hidden versioned runtime tree and registers an autostart mechanism appropriate to Windows, Linux, or macOS. The agent survives removal of the original npm project and can restart or upgrade itself. Concrete persistence identifiers are listed in verified_iocs. Remote access: the agent connects to a relay WebSocket as the agent role for a machine-specific session. An operator viewer paired to that session can enumerate filesystem roots and directories, read or archive files, delete files, execute shell commands, capture screenshots, upload selected content, and initiate WebRTC signaling for direct browser-to-agent control. The installer enables remote control without a local confirmation prompt by default. Credential and data theft: the startup audit is enabled by default and scans local files for secrets. Hugging Face upload is also enabled by default, and secret bodies are retained unless a separate redaction option is explicitly configured. The package discovers environment files and shell histories, collects host and foreground-window information, and synchronizes keyboard and clipboard events to a separate HTTP API. Browser extension harvesting: the payload searches Chromium-family browser profiles across Windows, Linux, and macOS for Local Extension Settings directories. Qualifying extension directories containing LevelDB table files are copied recursively into a staging area, including table, log, manifest, lock, and sibling files, then scheduled for upload after the secret audit. This can expose cryptocurrency-wallet extension state and other extension credentials. Cryptocurrency theft: clipboard text is checked for standalone addresses across multiple cryptocurrency families. When a match is found, the agent sends the original address and chain to the relay, receives an operator-configured replacement, silently overwrites the local clipboard, and records the substituted value. Exfiltration: secrets, extension databases, and operator-selected files can be committed to Hugging Face repositories using credentials supplied dynamically by the relay. Screenshots can be posted through Discord bot APIs or short-lived incoming webhook tickets. Interactive filesystem results and remote-control traffic pass through relay WebSocket or WebRTC channels. Legitimate third-party service domains are intentionally excluded from verified_iocs because no malicious account-specific repository or webhook identifier was recovered. Additional payload delivery: the relay advertises a package archive and exposes several legacy route names. Static server tracing showed that every legacy route calls the same archive-generation function and therefore serves the current package rather than a distinct payload. A single confirmed archive was downloaded as inert evidence with redirects disabled, hashed, and listed without installation or execution. The agent also contains conditional unattended npm upgrade commands controlled by relay version hints. Campaign lineage: compatibility fields and routes identify earlier package names used by the same code lineage. Registry checks reported that those names had been removed from npm. The legacy names are retained in verified_iocs for historical hunting, but no claim is made that their archived contents were independently recovered during this investigation. Analysis limitations: the sample was never executed, imported, compiled, installed, or emulated. No interactive C2 session was established. Dynamic Hugging Face repository identifiers, Discord webhook credentials, operator wallet replacement values, and commands sent to individual infected sessions were not available statically and remain unresolved.