GCVE-110-OSM-2026-11646

Package main (dist/index.mjs) locates dist/internal/mathcalc.mjs — a raw x86_64 ELF binary shipped under an.mjs extension and described in the README as a 'native math accelerator' — chmods it to 0755, verifies a pinned SHA-256, and spawns it detached via child_process.spawn on any require/import of the package. daymath.mjs contains a stub function with a comment stating it exists to make the math functions 'look like they rely on the binary', confirming the cover story. The ELF is a full remote-access implant (REDSHELL/SECURE_BEACON) that beacons to hardcoded C2 IP 217.60.77.63 and exfiltrates to https://litterbox.catbox.moe/resources/internals/api.php. Operator commands include /ssh_keys, /creds, /dbfind, /download and /dataextract for harvesting installer SSH private keys, credentials and databases, streamed chunked to POST /api/extract-receive. /redshell elf and /redshell bin fetch additional ELFs and shellcode over TLS-disabled HTTP into memfd (memfd_create syscall 319) or /tmp/.elf_XXXXXX and /tmp/.sc_XXXXXX for in-memory execution. /redshell persist writes ~/.config/systemd/user/svc-update.service (Description=System Update Service, Restart=always) and enables it via systemctl --user for login persistence. Extension-mismatched ELF, fake dependency stub, cover-story README, and hardcoded non-first-party C2 confirm intentional trojanization. ENTRY dist/index.mjs (main: ./dist/index.mjs) LOOT - Browser Data Theft in dist/internal/mathcalc.mjs: "firefox/*/logins.json; do [ -f "$p" ] || continue; PR=$(basename $(dirname "$p")..." PERSISTENCE - Cron Job Persistence in dist/internal/mathcalc.mjs: "crontab -" - Startup Persistence in dist/internal/mathcalc.mjs: ".bashrc" DESTINATION - 6 c2 (ipv4, urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Chai-Max Browser Data Theft in dist/internal/mathcalc.mjs: "BraveSoftware/Brave-Browser microsoft-edge; do for p in ~/.config/$b/*/Login" - Detached Child Process Payload in dist/index.mjs: "spawn(binaryPath, [], { stdio: 'pipe', shell: false, detached: true" - Very New NPM Publisher Account PAYLOAD FILES dist/internal/mathcalc.mjs