GCVE-110-OSM-2026-11653

The package's preinstall lifecycle script iterates process.env and filters keys for credential-shaped substrings (key, secret, token, pass, mnemonic, seed, private, wallet, rpc, infura, alchemy, api), attaches os.hostname(), process.cwd() and process.version, and POSTs the resulting JSON to a hardcoded remote host. The destination is written as an integer literal (759017974, decoding to 45.61.177.246) on port 61289 to evade string-based scanners. The package advertises itself as a contracts/ABI library and has no legitimate need to read or transmit environment secrets or host identifiers. Judge assessment: This is a credential-theft and data-exfiltration implant delivered via a preinstall hook: `package.json` runs `node preinstall.js`, and that file iterates `process.env` for secrets-shaped keys (`key`, `secret`, `token`, `mnemonic`, `rpc`, `infura`, `alchemy`, etc.) before POSTing the collected JSON off-host. The hardcoded destination uses an integer literal hostname (`759017974`) with port `61289`, which is consistent with deliberate scanner evasion and maps to a remote attacker-controlled endpoint. A smart-contract ABI/utilities package has no legitimate need to harvest environment secrets, `os.hostname()`, `process.cwd()`, and `process.version` at install time, so the attacker model is a supply-chain attacker stealing developer credentials and wallet/API material from anyone who installs the package. The OSV advisory MAL-2026-15851 is corroborated by the actual entrypoint content and the `env-exfiltration`/`http-exfiltration` findings. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - Environment Variable Exfiltration in preinstall.js: "process.env[k]; } } e._h = o.hostname(); e._c = process.cwd(); e._v = process.ve..." - HTTP Data Exfiltration in preinstall.js: "process.cwd(); e._v = process.version; const d = JSON.stringify(e); const r = h...." ADDITIONAL FINDINGS - Brand New Package PAYLOAD FILES preinstall.js