GCVE-110-OSM-2026-11039

The package is presented in its README as a set of day-math primitives, but dist/index.mjs runs a top-level async IIFE on import that chmod 0755's dist/internal/math.bin, verifies a hardcoded SHA-256, and cp.spawn's the ELF detached with stdio pipes. The shipped binary is not a math accelerator: strings inside dist/internal/math.bin identify it as a 'RedShell' remote-access implant with a command dispatcher exposing reverse-shell, /sysinfo, /ssh_keys, /creds, /dbfind, /clipboard, /env, /download, /upload, /dataextract, /shellcode, /memfd, SOCKS5 proxy, and port-forward capabilities. The implant beacons to a hardcoded C2 at 217.60.77.63, exfiltrates chunked file loot via HTTP POST /api/extract-receive, pulls follow-on payloads via curl over HTTP into memfd or /tmp with chmod +x, and installs user-level systemd persistence via svc-update.service. Simply importing the module launches a background process that gives a remote operator full shell, file, credential, and network control of the installer's host, with no advertised remote-access purpose and no user consent. The 'native math accelerator' naming and the SHA-256 integrity-pin framing serve as a cover story for the import-time C2 spawn. Judge assessment: This is a concealed remote-access implant masquerading as a math library: importing `dist/index.mjs` immediately chmods and detached-spawns `dist/internal/math.bin`, and the shipped binary contains browser credential theft, cron/startup persistence, and C2 indicators. The attacker model is a supply-chain compromise or trojanized npm package intended to infect developers and exfiltrate their data on install/import, not a legitimate native accelerator. The literal IOC set (`217.60.77.63`, `https://litterbox.catbox.moe/resources/internals/api.php`, `http://%s:%d/Others/%s`, `http://%s:%d/SC/%s`) plus the `browser-data-theft`, `cron-persistence`, and `startup-persistence` findings are consistent with an implant that steals credentials and maintains persistence. The OSV MAL advisory is corroborated by the code path here: the benign README story is contradicted by import-time process spawning and the credential/persistence strings embedded in `dist/internal/math.bin`. ENTRY dist/index.mjs (main: ./dist/index.mjs) LOOT - Browser Data Theft in dist/internal/math.bin: "firefox/*/logins.json; do [ -f "$p" ] || continue; PR=$(basename $(dirname "$p")..." PERSISTENCE - Cron Job Persistence in dist/internal/math.bin: "crontab -" - Startup Persistence in dist/internal/math.bin: ".bashrc" DESTINATION - 6 c2 (ipv4, urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Chai-Max Browser Data Theft in dist/internal/math.bin: "BraveSoftware/Brave-Browser microsoft-edge; do for p in ~/.config/$b/*/Login" - Binary: Credential Theft in dist/internal/math.bin: "N=0; for b in google-chrome chromium BraveSoftware/Brave-Browser microsoft-edge;..." - Detached Child Process Payload in dist/index.mjs: "spawn(binaryPath, [], { stdio: 'pipe', shell: false, detached: true" - Brand New Package - Very New NPM Publisher Account - Binary: Shell in dist/internal/math.bin: "/bin/sh" (+1 more) PAYLOAD FILES dist/internal/math.bin