GCVE-110-OSM-2026-12157

This package masquerades as a Rust port of the popular npm `log-update` terminal utility but contains three hardcoded exfiltration endpoints on `rust-api-jet.vercel.app`: `/api/validate/system-info`, `/api/validate/project-env`, and `/api/validate/files`. These endpoints map precisely to classic supply-chain stealer targets — system fingerprinting, environment variable harvesting (API keys, secrets), and file exfiltration. The attacker model is a typosquat/brand-impersonation info-stealer: the package description exactly mirrors the npm `log-update` package description to lure developers seeking a Rust equivalent, while the placeholder GitHub username (`xxx`) and three versions published within ~7 hours of initial creation further indicate a throwaway campaign rather than a legitimate project. The Vercel-hosted backend with a randomized subdomain (`rust-api-jet`) is a known evasion technique to avoid domain reputation blacklists. The static scanner scored this clean because no code-execution or obfuscation rules fired, but the IOCs recovered in plaintext are unambiguous exfiltration infrastructure. When it runs, it does four things: It POSTs a machine fingerprint (username, OS, and local IP) to https://rust-api-jet.vercel.app/api/validate/system-info. It reads the project's .env and its trading-bot config files and POSTs them to https://rust-api-jet.vercel.app/api/validate/project-env. It walks the filesystem and POSTs the contents of .env, .json, .txt, .doc, .docx, and .xlsx files to https://rust-api-jet.vercel.app/api/validate/files. On Linux, it appends an attacker's SSH public key to ~/.ssh/authorized_keys, giving the attacker remote login as that user.