GCVE-110-OSM-2026-13006

Compromised version 1.4.9 of @or-sdk/invitations, infected via worm propagation from the Shai-Hulud supply chain attack. A maintainer who installed one of the primary compromised packages had their npm tokens stolen, allowing the attacker to publish a poisoned version with the same infostealer payload. Malicious payload found in: setup.mjs, Math_Symbol.js Trigger: preinstall script in package.json: node setup.mjs Behavior: Downloads Bun runtime, executes Math_Symbol.js infostealer targeting npm/GitHub/AWS/K8s/Vault/Stripe/Slack credentials, SSH keys, .env files, private keys. Exfiltrates encrypted data to GitHub repo. Infection vector: Worm propagation from primary Shai-Hulud compromise.