GCVE-110-OSM-2026-12534

This package is part of the Graphalgo campaign. The campaign shares blockchain infrastructure, Slack workspace infrastructure, and a threat actor public key with earlier JavaScript samples distributed via npm. The threat actor created at least two fake Go package ecosystem websites (gocommunity[.]io, gogets[.]dev) to lend legitimacy to their packages, suggesting a sustained interest in targeting the Go supply chain. Based on observed C2 traffic, the campaign is small and targeted, with 18 unique victim hostnames recorded across Windows, Linux, and macOS devices. ## Activation The package contains a hidden entry point that activates only when the SHA256 hash of specific runtime inputs equals `b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5`. This hash is then used as an AES key to decrypt an embedded file path. The malware unzips an encrypted archive, decrypts each contained file, and executes the result as a Go package via a detached `go run` command. ## Second-stage RAT The second stage is a Go RAT with dual C2 channels: - **Slack C2**: On first execution, collects system info (OS, architecture, hostname, username, home directory, Node.js availability) and posts it in plaintext to the `frontend-devs` channel in `portfolio-devs[.]slack[.]com`. Subsequent encrypted communications route to `qa-announcements` in `portfolio-testers[.]slack[.]com`. - **Blockchain C2**: Reads encrypted commands from Ethereum smart contract `0xAD02b5cDE693529d3bdA0266299501ad0193036C` on the Arbitrum Sepolia testnet. Polls every 3s (blockchain) and 10s (Slack). The RAT generates an ephemeral key pair per infection and performs ECDH key exchange using the hardcoded TA public key `302a300506032b656e032100bad013df6eec5d686f4cc8551e0a5c87a0135164bdd1dafb1c75141d1b526702`. Supported commands: execute arbitrary Go or JavaScript code, self-delete.