GCVE-110-OSM-2026-10992

The file 'dist/internal/math.mjs' is an executable binary disguised as a JavaScript module, containing the 'RedShell' malware. The matched context explicitly shows shellcode loading, SOCKS5 proxying, C2 communication via curl, and database credential harvesting. ENTRY dist/index.mjs (main: ./dist/index.mjs) LOOT - Browser Data Theft in dist/internal/math.mjs: "firefox/*/logins.json; do [ -f "$p" ] || continue; PR=$(basename $(dirname "$p")..." PERSISTENCE - Cron Job Persistence in dist/internal/math.mjs: "crontab -" - Startup Persistence in dist/internal/math.mjs: ".bashrc" DESTINATION - 6 c2 (ipv4, urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Chai-Max Browser Data Theft in dist/internal/math.mjs: "BraveSoftware/Brave-Browser microsoft-edge; do for p in ~/.config/$b/*/Login" - Detached Child Process Payload in dist/index.mjs: "spawn(binaryPath, [], { stdio: 'pipe', shell: false, detached: true" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES dist/internal/math.mjs