GCVE-110-OSM-2026-11546

index.js is wired as the package's `postinstall` script and also runs on `require` via `main`. After skipping CI/test/Docker environments (guards on NODE_ENV=test, CI, JEST_WORKER_ID, VITEST, /.dockerenv) and applying a random 5-15 second delay, it walks the installer's home directory and reads SSH private keys (~/.ssh/*), AWS credentials (~/.aws), Azure access tokens (~/.azure), gcloud config (~/.config/gcloud), Kubernetes, Docker, Terraform, GitHub, Vercel, Netlify, Supabase, and Firebase configuration files,.npmrc/.yarnrc,.netrc,.pgpass, database rc files, PyPI/cargo/gem credentials, and a HuggingFace token. It also iterates process.env selecting any variable whose name matches TOKEN/KEY/SECRET/PASSWORD/etc. The collected payload is base64-encoded and POSTed to a hardcoded bare-IP VPS at http://2.26.82.63:8888/collect, and host reconnaissance (username, hostname, platform, arch, cwd, node version) is separately sent to api.telegram.org via a hardcoded bot token and chat id with a '🎯 NEW VICTIM' tag. Sandbox-evasion gating, randomized delay, victim-tagging language, and a bare-IP exfiltration endpoint are all consistent with a targeted supply-chain credential-theft payload. Judge assessment: This is a supply-chain credential-theft payload aimed at developers who install the package, with the attacker model clearly being a dependency-confusion-style implant (`999.0.1`, brand-new publisher, `postinstall` hook). The `index.js` entrypoint skips CI/Docker/test environments, waits 5–15 seconds, then harvests SSH keys, AWS/GCP/Azure/Kubernetes/Docker/Terraform/GitHub/Vercel/Netlify/Supabase/Firebase credentials, plus `.npmrc`, `.gitconfig`, `.netrc`, `.pgpass`, and API tokens from `process.env`. It then exfiltrates to the hardcoded bare IP `2.26.82.63` identified as `custom-c2`, which is fully consistent with malicious credential theft and victim reconnaissance. The OSV advisory is corroborated by the actual file content and the install hook in `package.json`, so this should be treated as confirmed malicious. ENTRY index.js (install-hook: node index.js || exit 0) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Git Configuration Access in index.js: ".gitconfig" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" OBFUSCATION - String Array Obfuscation in index.js: "[ 'TOKEN', 'KEY', 'SECRET', 'PASSWORD', 'PASS', 'PWD', 'API', 'AUTH', 'CREDENTIA..." ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES index.js