GCVE-110-OSM-2026-11544

bt2-api-gateway-node-js@999.0.1 runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — ~/.ssh private keys, ~/.aws/{credentials,config,sso/cache}, ~/.azure, gcloud ADC, ~/.kube/config, ~/.docker/config.json, gh hosts.yml, ~/.netrc, ~/.npmrc, ~/.pypirc, ~/.gem/credentials, ~/.cargo/credentials, ~/.pgpass, ~/.my.cnf, and vercel/netlify/supabase/firebase tokens — and sweeps process.env for TOKEN/KEY/SECRET/PASSWORD and AWS/AZURE/GITHUB/STRIPE variables. The collected data is JSON-serialized, base64-encoded, and POSTed to two hardcoded destinations: the Telegram Bot API (api.telegram.org/bot<token>/sendMessage) and http://2.26.82.63:8888/collect over plain HTTP. Execution aborts if NODE_ENV=test, CI=true, JEST_WORKER_ID or VITEST is set, or /.dockerenv exists, and is delayed by a randomized 5–15 second setTimeout to evade CI and sandbox observation. The version number (999.0.1) and package name are consistent with a dependency-confusion lure targeting an internal 'bt2-api-gateway' package. Judge assessment: This is a credential-stealer and dependency-confusion lure aimed at developers installing the npm package: the postinstall hook runs `node index.js`, and the entrypoint reads high-value secrets from `~/.ssh`, `~/.aws`, `~/.azure`, gcloud, kube, docker, gh, netrc, pypi, cargo, and editor/config files before sweeping `process.env` for TOKEN/KEY/SECRET/PASSWORD and cloud/vendor variables. The code then serializes collected data and exfiltrates it to the hardcoded C2 `2.26.82.63` over HTTP, with the IOC classified as exfil and tied to `git-config-access`, `network-request`, and `system-info-collection`; the OSV advisory’s Telegram bot path is also consistent with the theft/exfil intent. The package name/version (`bt2-api-gateway-node-js@999.0.1`) and brand-new publisher account strongly fit a dependency-confusion attacker model targeting an internal service package, not a legitimate gateway library. ENTRY index.js (install-hook: node index.js || exit 0) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Git Configuration Access in index.js: ".gitconfig" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" OBFUSCATION - String Array Obfuscation in index.js: "[ 'TOKEN', 'KEY', 'SECRET', 'PASSWORD', 'PASS', 'PWD', 'API', 'AUTH', 'CREDENTIA..." ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES index.js