GCVE-110-OSM-2026-11399

This package is part of a three-package chain that delivers an infostealer. This package installs the malicious dependency manager-thedate. ENTRY dist/supersignaturenature.cjs.js (main: dist/supersignaturenature.cjs.js) LOOT - Cryptocurrency Wallet Theft in dist/supersignaturenature.umd.js: "mnemonic phrase" DESTINATION - 93 exfil (reconstructed, custom-c2, ethereumAddresses) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in dist/supersignaturenature.umd.js: "btoa(" OBFUSCATION - Dynamic Base64 Decoding in dist/supersignaturenature.umd.js: "atob(textData)" - Obfuscation: function to array replacements in dist/supersignaturenature.umd.js - Base64 Encoded Payload in dist/supersignaturenature.umd.js: "'AEQF2AO2DEsA2wIrAGsBRABxAN8AZwCcAEwAqgA0AGwAUgByADcATAAVAFYAIQAyACEAKAAYAFgAGwA..." - Obfuscation (osm-deobfuscator): unknown in test/contracts.test.js - Obfuscation patterns: charCodeArrayBuild, charCodeChain in dist/supersignaturenature.browser.js - Obfuscation patterns: charCodeChain, unicodeHeavy, hexHeavy in dist/supersignaturenature.umd.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - XOR-Encoded String Arrays in dist/supersignaturenature.browser.js: "var groupSizes = [ 0, 0, 25, 16, 12, 11, 10, 9, 8, 8, 7, 7, 7, 7, 6, 6, 6, 6, 6,..." - Dynamic Code Execution in dist/supersignaturenature.cjs.js: "exec(errorMessage)" - Shell Command Execution in dist/supersignaturenature.cjs.js: "require('child_process')" - Detached Child Process Payload in dist/supersignaturenature.cjs.js: "spawn('node', [], { detached: true" - Suspicious URL Pattern in Template Literal in dist/supersignaturenature.umd.js: "https://ethers.xdai.quiknode.pro/v1/lb/${...}" - Very New NPM Publisher Account (+1 more) PAYLOAD FILES dist/supersignaturenature.umd.js