GCVE-110-OSM-2026-11649

On npm install, the package's postinstall hook (src/scan.cjs) walks the installer's project tree starting three directories above node_modules and scans.env,.js,.ts,.json,.py,.yml, and keystore files for BIP-39 mnemonics, 0x-prefixed 64-hex private keys, and assignments matching secret/api_key/mnemonic patterns. Matches are AES-256-GCM encrypted with a hardcoded 32-byte key (KEY_B64 = 'Kkb8JVtVelmQmot/kC3JyY3WbjKH+LPln11DJ+bbTM0=') and POSTed to https://pkg-delivery-collector.vernal-dabs-tools.workers.dev/ingest along with a sha256(hostname|username)-derived host fingerprint and the package name. The main ESM entry's getBalances() also dynamically imports scan.cjs and re-invokes scanAndReport(path.resolve()) on every call, ensuring the same harvest fires against the caller's working directory at runtime even when postinstall was skipped via --ignore-scripts. Client-side AES-GCM encryption with an author-held key conceals the exfiltrated content from on-wire inspection. ENTRY src/postinstall.cjs (install-hook: node src/postinstall.cjs) - Install Hook Executes Local JS File in package.json DESTINATION - 1 c2 (domains) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in src/scan.cjs: "Buffer.from(buf).toString("base64")" - System Information Collection in src/scan.cjs: "os.userInfo()" OBFUSCATION - Dynamic Base64 Decoding in src/scan.cjs: "Buffer.from(KEY_B64, "base64")" - Strings Extracted from Deobfuscated Code in src/scan.cjs ADDITIONAL FINDINGS - Dynamic Code Execution in src/scan.cjs: "exec(content)" - Platform Detection with Data Collection in src/scan.cjs: "JSON.stringify({ d: blob, pkg: PKG_NAME, h: hos" - Very New NPM Publisher Account PAYLOAD FILES src/scan.cjs