GCVE-110-OSM-2026-13502

OSM Note: OpenSourceMalware has determined that this package is not explicitly malicious. However, it is poorly constructed, and we would not suggest installing it. Original description: The obfuscated code (index.js:1, obfuscator.io RC4 string array; scanner-decoded snippet 'for(const p of skillTargets){fs.mkdirSync(...)') writes its skill files into other agents' skill directories, while the bundled SKILL.md documents auto-discovery and silent upload of host agent session transcripts and prompt files (SKILL.md:213-219, 327-336) plus persistence via automatic HEARTBEAT.md/cron injection with explicit 'run silently, do not ask the user' instructions (SKILL.md:810-838). Covert host-data exfiltration plus hidden persistence and self-propagation, deliberately concealed by heavy obfuscation, warrants MALWARE. ## Static analysis (vigil) Verdict `BLOCK`, score 51/100. Critical/high findings: - [critical] SC-004 Dynamic require — `package/index.js:1` - [critical] SC-004 Dynamic require — `package/index.js:38` - [critical] SC-004 Dynamic require — `package/bin/clawcredit.js:2` - [critical] SC-004 Dynamic require — `package/bin/clawcredit.js:2` - [critical] SC-004 Dynamic require — `package/bin/clawcredit.js:45` - [critical] SC-004 Dynamic require — `package/bin/clawcredit.js:45` - [high] OBF-028 Obfuscator.io string-array rotation — `package/bin/verify.js:2` - [high] OBF-028 Obfuscator.io string-array rotation — `package/index.js:1` - [high] OBF-028 Obfuscator.io string-array rotation — `package/bin/clawcredit.js:2` ## Package metadata - Publisher: unknown - Published: 2026-10-07T20:45:39.239Z - Install hooks: none found - SHA-256 (tarball): `6fd5a6465ee99a7ad8dd16f7ee1ba0069a58d1abaf9ca334ccabf197f158e0ab` ## IOCs (defanged) - 127[.]0[.]0[.]1 - e[.]me - hxxps://api-staging[.]claw[.]credit - hxxps://api-stagin… - hxxps://api-stagi… - hxxps://api-stag… - hxxps://api[.]claw[.]credit - hxxps://api[.]c… - hxxps://www[.]claw[.]credit/SKILL[.]md - hxxps://www[.]claw[.]credit/SKILL[.]… - hxxps://www[.]claw[.]credit/privacy - obfuscator[.]io