GCVE-110-OSM-2026-13455

On require('@galicia-toolkit-nestjs-20/paas'), index.js unconditionally loads prebuilds/<platform>-<arch>/metrics.node at module top level inside a try/catch. The shipped ELF addon reads AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, SYSTEM_ACCESSTOKEN, ACTIONS_RUNTIME_TOKEN, and ACTIONS_ID_TOKEN_REQUEST_TOKEN from the process environment, together with hostname, uid, and cwd, and POSTs them as JSON to oob.s4yhii.com over a raw socket (gethostbyname/connect/send, request line 'POST /native HTTP/1.0'). The addon uses fork+setsid to background the exfiltration. The package ships no C/C++ source and no binding.gyp, is self-labeled as a NestJS toolkit, and the only on-load effect of the stub is to execute this opaque native binary. Strings observed inside metrics.node include 'AWS_SECRET_ACCESS_KEY', 'GITHUB_TOKEN', 'NPM_TOKEN', 'ACTIONS_RUNTIME_TOKEN', 'oob.s4yhii.com', and the hardcoded HTTP request format. The scoped name under an organization-shaped '@galicia-toolkit-nestjs-20' namespace combined with the implausibly high 999.0.1 version is consistent with a dependency-confusion lure designed to win resolution against an internal package. Judge assessment: This package is a dependency-confusion attack targeting CI/CD and developer environments. The index.js entrypoint unconditionally loads a prebuilt native addon (prebuilds/<platform>-<arch>/metrics.node) at import time inside a silent try/catch, consistent with the OSV advisory's description of the ELF binary reading AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, NPM_TOKEN, and related CI tokens, then exfiltrating them via raw socket POST to oob.s4yhii.com. The attacker model is credential theft from CI pipelines via a dependency-confusion lure: the package name mimics an internal '@galicia-toolkit-nestjs-20' namespace, the version 999.0.1 is artificially inflated to win resolution over private registry entries, and no source or binding.gyp is shipped — only the opaque binary payload. Publisher 's4yhii__' has a brand-new account with 5 previously confirmed malicious packages (@s4yhiitestpoc/r3-https at critical severity, plus four others at high), all consistent with a sustained dependency-confusion campaign. The OSV advisory's claims are fully corroborated by the entrypoint code and metadata evidence. ENTRY index.js (main: index.js) EXFIL - System Information Collection in index.js: "os.platform()" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js