GCVE-110-OSM-2026-12087

Malicious npm package impersonating a legitimate JavaScript prototype utility. Loading the package activates a concealed, encrypted multistage chain that installs a detached cross-platform Node.js credential stealer and remote-access backdoor. It collects cloud and SSH credentials, browser login databases, cryptocurrency-wallet extension data, sensitive local files, host identifiers, and public IP metadata; it also supports arbitrary command execution, file retrieval, and persistence. Related campaign infrastructure serves a Windows Python keylogger and clipboard-stealing agent. The chain is strongly consistent with the DPRK-aligned Contagious Interview/DeceptiveDevelopment operation and evolved BeaverTail/OtterCookie tradecraft; the Python agent is InvisibleFerret-aligned, but its exact family identity is not independently confirmed. On import, index.js Base64-decodes two files disguised as source maps into config.js and parsetmp.js, loads the latter, and schedules deletion of both source maps and generated scripts. The embedded loader obtains an encrypted JSON session, derives an AES-256-CBC key with scrypt using the hardcoded password myPassword123 and salt value salt, decrypts the response, and evaluates the plaintext. The recovered next stage creates Programs_X64 beneath the operating-system temporary directory, writes an embedded main.js loader and, on Windows, a hidden main.vbs launcher. It runs npm initialization and installs axios, node-machine-id, and socket.io-client before launching main.js as a detached background Node process. That loader retrieves and evaluates another encrypted stage using the same cryptographic parameters. The final JavaScript stage is a cross-platform credential stealer and Socket.IO backdoor. It registers a hostname and machine identifier, collects OS and public-IP metadata, and exfiltrates files with multipart POST requests. On C2 connection it recursively uploads gcloud, AWS, Azure, and SSH configuration directories. Operator commands can search for .env files, wallet and seed material, arbitrary filename patterns, upload individual files or directories, read text files, browse directories, change working directories, stop searches, and execute arbitrary shell commands with output returned to C2. Collection targets Chrome, Brave, Opera, Yandex, and Edge profiles; browser login databases and keychain material; eight cryptocurrency-wallet browser extensions; Exodus, Guarda, Electrum, and Atomic wallet data; shell histories; and small text or spreadsheet files whose names or contents resemble passwords, mail credentials, or recovery phrases. Persistence uses a per-user Windows Run value named MyNodeStartupScript that invokes main.vbs, a macOS LaunchAgent named com.MyNodeStartupScript.plist, or an XDG autostart entry named MyNodeStartupScript.desktop. A related downloader branch is present but commented out and therefore inactive in this sample. Its verified endpoint served a PyInstaller-packaged Python 3.12 Windows executable. Static analysis of that executable recovered a keyboard and clipboard surveillance agent that automatically starts after connecting, transmits keydown and keyup events with modifiers and timestamps, polls for changed clipboard text approximately every 100 milliseconds, handles remote capture and clipboard commands, and sends a heartbeat every 30 seconds. No active additional downloader was found in the Python agent. Execution caveats: the final JavaScript stage requires xlsx, which the preceding installer does not install; several wallet and browser routines contain implementation errors; express.js is referenced by a signal-handler restart branch but is absent; actual operator-issued shell commands and their possible follow-on artifacts remain unavailable. No blockchain activity was found.