GCVE-110-OSM-2026-13454

On require(), index.js loads a bundled ELF native addon at prebuilds/linux-x64/metrics.node inside a silent try/catch. The addon reads CI/cloud credential environment variables (AWS_SECRET_ACCESS_KEY and related AWS_*, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, ACTIONS_RUNTIME_TOKEN, SYSTEM_ACCESSTOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN) along with hostname, user, and cwd, and POSTs them as JSON to the hardcoded non-first-party host oob.s4yhii.com at the path /native. The addon also calls fork and setsid to detach from the loader process after transmission, so the exfiltration continues in the background without blocking the caller. The package ships at version 999.0.1 under scope @galicia-toolkit-nestjs-20 with no library functionality beyond loading this addon — the inflated version, scope-mimicry, and payload-only contents are the canonical dependency-confusion shape. Packaging the exfiltration logic as a compiled.node binary rather than JavaScript, combined with the silent try/catch loader and the fork+setsid detach, is deliberate anti-analysis around the credential-theft primitive. Judge assessment: This is a dependency-confusion attack targeting internal @galicia-toolkit-nestjs-20 packages. The OSV advisory (MAL-2026-17726) describes a bundled native ELF addon at prebuilds/linux-x64/metrics.node that exfiltrates CI/cloud credentials (AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, NPM_TOKEN, ACTIONS_RUNTIME_TOKEN, etc.) along with hostname/user/cwd via HTTP POST to the attacker-controlled host oob.s4yhii.com/native, then forks and detaches to continue exfiltration in the background. The entrypoint (index.js) confirms the loader pattern: it silently requires a platform-specific .node binary inside a try/catch with no error handling, using os.platform()+os.arch() to select the payload — consistent with the described anti-analysis technique. The version 999.0.3 is a classically inflated dependency-confusion version number, and the publisher 's4yhii__' (account age ~0 days, 27 packages) has 5 other packages already confirmed malicious in OSM including a critical-severity one (@s4yhiitestpoc/r3-https), making this part of an active campaign. The attacker model is credential theft from CI/CD pipelines via dependency confusion, with deliberate evasion via compiled native binary and silent catch. ENTRY index.js (install-hook: node index.js || true) - Install Hook Executes Local JS File in package.json EXFIL - System Information Collection in index.js: "os.platform()" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js