GCVE-110-OSM-2026-10710

main.js imports child_process and issues POST requests to a hardcoded endpoint at https://ipc.shadxino.internal (referenced at lines 358 and 452, with POST calls at lines 364 and 368). The destination is not a documented public service and combined with child_process usage in the same module matches the shape of an installer-side data exfiltration / remote-command channel. The `.internal` TLD is non-routable on the public internet, suggesting either a lure destination or infrastructure meant to be resolved via a custom resolver on compromised hosts. Judge assessment: This looks like a credential-theft and persistence payload disguised as a DOM/diagnostic utility, consistent with a third-party attacker model targeting npm consumers. The entrypoint `bin/kalamasha-tool.js` hides itself via detached `spawn(...)` with `stdio: 'ignore'`, clones `electron.exe` to `SearchApp.exe`, and respawns as a background watchdog, while `main.js` loads browser/session tokens and persists via `.profile`/startup-style behavior. Most importantly, `main.js` contains explicit exfiltration to `https://ipc.shadxino.internal/login_post` and related `.internal` endpoints, plus the `chai-max-browser-theft` rule matches Chrome/Brave cookie access in `bin/chrome_cookies.ps1`. The combination of `dynamic-code-execution`, `startup-persistence`, and recovered custom-C2 IOCs is not compatible with a legitimate library. ENTRY bin/kalamasha-tool.js (bin: bin/kalamasha-tool.js) - Postinstall Script in package.json: ""postinstall": "node -e \"" PERSISTENCE - Startup Persistence in main.js: ".profile" - Startup Persistence in profile-picker.html: ".profile" DESTINATION - 6 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Collection in main.js: "process.platform" - Network Request in profile-picker.html: "fetch('https:" OBFUSCATION - Whitespace-Padded Hidden Payload in main.js: "; let" - Dynamic Base64 Decoding in main.js: "atob(parts[" - Deobfuscation Failed in main.js ADDITIONAL FINDINGS - Chai-Max Browser Data Theft in bin/chrome_cookies.ps1: "BraveSoftware\Brave-Browser\User Data" if (Test-Path $bravePath) { $cookies = Ge..." - Stealth Background Process Spawning in bin/kalamasha-tool.js: "spawn(process.execPath, [__filename, '--background'], { detached: true, stdio: '..." - Shell Command Execution in bin/kalamasha-tool.js: "require('child_process')" - Silent Process Execution in bin/kalamasha-tool.js: "stdio: 'ignore'" - Detached Child Process Payload in bin/kalamasha-tool.js: "spawn(finalPath, [mainPath], { stdio: 'ignore', detached: true" - Dynamic Code Execution in main.js: "exec(text)" (+3 more) PAYLOAD FILES main.js