GCVE-110-OSM-2026-10733

The package configures Langfuse tracing for Claude Code, Codex, and OpenCode. When the operator runs the bundled CLI without explicitly overriding `--langfuseBaseUrl`, the setup writes `LANGFUSE_BASEURL=http://120.46.221.227:3000` together with hardcoded public and secret Langfuse keys into `~/.claude/settings.json`, `~/.codex/config.toml`, OpenCode environment files, and shell shims (bin/cli.js lines 11-13 hardcode `DEFAULT_LANGFUSE_BASE_URL = "http://120.46.221.227:3000"`, `DEFAULT_LANGFUSE_PUBLIC_KEY = "pk-lf-da0c90a7-..."`, and `DEFAULT_LANGFUSE_SECRET_KEY = "sk-lf-0269b85d-..."`; scripts/langfuse-setup.mjs and scripts/opencode-langfuse-run.mjs reuse the same secret-key default). The installed Python hooks then ship every Claude/Codex turn — user prompts, assistant responses, tool inputs, and tool outputs (which routinely include file contents and any secrets observed in tool calls) — to that bare IPv4 endpoint. The destination is the publisher's own Langfuse instance, presented to the operator only as a numeric IP with no publisher-domain branding, served over cleartext HTTP, and pre-authenticated with credentials baked into the package. An additional fallback path in scripts/langfuse-setup.mjs downloads a hooks zip from `https://gitcode.com/user-attachments/files/8187690/7a797a5314b9497cae7b055aa51be646.zip` via PowerShell Invoke-WebRequest and installs it as the Claude Code Stop hook when both `--pyPath` is absent and the bundled `langfuse_hook.py` is missing — normally bypassed, but a brittle path to third-party-hosted code that Claude Code will execute. The trigger is the operator running the CLI with defaults (or `--yes`), not `npm install`; however, the documented invocation pattern of this package is to run that CLI, and the default behavior silently relays caller-supplied agent data (containing the operator's own code and secrets) to a publisher-controlled destination. Judge assessment: This package implements a covert data exfiltration scheme targeting AI coding tool users (Claude Code, Codex, OpenCode). The entrypoint `bin/cli.js` hardcodes `DEFAULT_LANGFUSE_BASE_URL = "https://metrics.openharmonyhub.cn"` (previously `http://120.46.221.227:3000`) along with baked-in API keys (`pk-lf-da0c90a7-...`, `sk-lf-0269b85d-...`), routing all AI agent telemetry — including user prompts, assistant responses, tool inputs/outputs, and any secrets observed in tool calls — to a publisher-controlled endpoint masquerading as a legitimate Langfuse tracing server. The `LEGACY_LANGFUSE_BASE_URLS` set confirms the publisher migrated from a bare IP endpoint to a branded `.cn` domain while preserving backward compatibility, demonstrating deliberate infrastructure evolution. A secondary dropper path in `scripts/langfuse-setup.mjs` fetches a zip from `https://gitcode.com/user-attachments/files/8187690/7a797a5314b9497cae7b055aa51be646.zip` and installs it as an execution hook, constituting a download-execute pattern with third-party-hosted code. The OSV advisory MAL-2026-4625 is fully corroborated by the visible source: the hardcoded credentials, C2 infrastructure migration, and hook installation behavior are all confirmed in the entrypoint and script files. The attacker model is systematic prompt/response harvesting from developer AI tools, with 84 published versions indicating a sustained campaign. ENTRY bin/cli.js (bin: bin/cli.js) PERSISTENCE - Startup Persistence in scripts/opencode-langfuse-check.mjs: ".bashrc" - Startup Persistence in scripts/opencode-langfuse-setup.mjs: ".bashrc" DESTINATION - 17 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in scripts/real-self-verify.mjs: "process.env.LANGFUSE_VERIFY_REQUEST_TIMEOUT_MS || 15000)); const response = awai..." - Data Encoding for Exfiltration in codex_langfuse_notify.py: "json.dumps(seed, ensure_ascii=False, sort_keys=True).encode" - Data Encoding for Exfiltration in scripts/real-self-verify.mjs: "Buffer.from(`${publicKey}:${secretKey}`, "utf8").toString("base64")" - System Information Collection in bin/cli.js: "process.platform" - Suspicious Domain in bin/cli.js: "http://120.46.221.227" - System Information Collection in scripts/auto-update-runtime.mjs: "process.platform" - System Information Collection in scripts/cli-detection-utils.mjs: "os.homedir()" - System Information Collection in scripts/codex-langfuse-check.mjs: "os.homedir()" (+17 more) OBFUSCATION - Unicode Escape Obfuscation in scripts/auto-update-runtime.mjs: "\u6b63\u5728\u6267\u884c\u66f4\u65b0\u547d\u4ee4\uff1a" - Unicode Escape Obfuscation in scripts/update-langfuse-runtime.mjs: "\u5f53\u524d\u672a\u68c0\u6d4b\u5230" ADDITIONAL FINDINGS - Download Execute Delete Pattern in scripts/codex-langfuse-setup.mjs: "writeFileSync(shim, lines.join("\n"), "utf8"); fs.chmodSync(shim, 0o755); return..." - Shell Command Execution in bin/cli.js: "spawnSync(" - Shell Command Variable Setup in bin/cli.js: "WindowsShellScript = process.platform === "win32" && /\.(cmd|bat)$/i.test(comman..." - Silent Process Execution in scripts/auto-update-runtime.mjs: "windowsHide: true" PAYLOAD FILES scripts/real-self-verify.mjs (+ scripts/opencode-langfuse-setup.mjs, scripts/codex-langfuse-setup.mjs)