GCVE-110-OSM-2026-13

This package is a supply-chain implant masquerading as a typosquat of electron-builder ('electron-buidler'). On first require, an IIFE executes targeting macOS only (platform check), skips CI environments to evade automated analysis, writes a one-shot sentinel file at ~/.cache/.nyx-npm/eb to prevent re-execution, then after a randomized 30–90 second delay fetches a dead-drop C2 URL from https://raw.githubusercontent.com/nyx-deploy/config/main/c2.txt. It then base64-decodes the hardcoded C2 'aHR0cHM6Ly9rN3htOXEueHl6' (https://k7xm9q.xyz) and performs two detached, unref'd shell spawns: first a beacon to /api/clickfix-callback exfiltrating username, hostname, and a hardcoded password token 'npm_electron-buidler'; second a pipe of /api/payload/ directly into /bin/bash, constituting a remote code execution loader. The attacker model is a staged macOS payload delivery system with environment fingerprinting, sandbox evasion, and remote-controlled C2 infrastructure consistent with a Contagious Interview / ClickFix-style campaign. ENTRY index.js (main: index.js) DESTINATION - custom-c2: https://k7xm9q.xyz (primary, decoded) in index.js - custom-c2: k7xm9q.xyz (decoded) in index.js EXFIL - Network Request in index.js: "http.get(" - System Information Collection in index.js: "os.hostname()" OBFUSCATION - Decoded Base64 Content in index.js - Decoded Base64 Content in [deobfuscated] index.js - Dynamic Base64 Decoding in index.js: "atob(s)" - Strings Extracted from Deobfuscated Code in index.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn(s1, a1, { detached: true, stdio: 'ignore' }); c1.unref(); setTimeout(funct..." - Shell Command Execution in index.js: "child_process').spawn" - Silent Process Execution in index.js: "stdio: 'ignore'" - Detached Child Process Payload in index.js: "spawn(s1, a1, { detached: true" - Brand New Package - Rapid Version Publishing PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 610475c54a6f7c8a3ca10f849b6fd413f5a50c32d691f4d88db846dc439ee035