GCVE-110-OSM-2026-11398

This package is part of a three-package malicious chain that delivers an infostealer. This package installs the malicious dependency supersignaturenature. ENTRY devnet/bitcannadevnet2/index.js (main: index.js) DESTINATION - 50 exfil (ethereumAddresses) (values recorded in verified_iocs) EXFIL - Suspicious Domain in devnet/bitwaydevnet/chain.js: "http://45.77.249.30" - Suspicious Domain in devnet/prysmdevnet/chain.js: "http://144.76.70.103" - Suspicious Domain in esm/devnet/bitwaydevnet/chain.js: "http://45.77.249.30" - Suspicious Domain in esm/devnet/prysmdevnet/chain.js: "http://144.76.70.103" - Suspicious Domain in esm/mainnet/bluechip/chain.js: "https://bluechipsblockexplorer.com" - Suspicious Domain in esm/mainnet/chain4energy/chain.js: "http://185.245.182.192" - Suspicious Domain in esm/mainnet/cifer/chain.js: "http://119.59.126.109" - Suspicious Domain in esm/mainnet/humans/chain.js: "http://65.21.46.90" (+14 more) OBFUSCATION - Base64 Encoded Payload in esm/mainnet/gateway/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/46Y..." - Base64 Encoded Payload in esm/mainnet/injective/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in esm/mainnet/kujira/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in esm/mainnet/osmosis/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in mainnet/gateway/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/46Y..." - Base64 Encoded Payload in mainnet/injective/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in mainnet/kujira/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in mainnet/osmosis/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." ADDITIONAL FINDINGS - Suspicious TLD Domain in devnet/prysmdevnet/chain.js: "https://rpc-prysm.vinjan.xyz" - Very New NPM Publisher Account PAYLOAD FILES devnet/prysmdevnet/chain.js (+ esm/devnet/prysmdevnet/chain.js, esm/mainnet/chain4energy/chain.js)