GCVE-110-OSM-2026-13880

Trojanized private fork of the legitimate Adamant-im/adamant-tradebot project containing an intentional remote-code-execution backdoor. modules/configReader.js line 376 executes eval() on a remotely-fetched, remotely-decrypted payload on every application start, with the endpoint base64-encoded in source to evade detection. Delivered to victims via fake job recruitment: targets were offered work, asked for their GitHub account, granted repository access, and told to set up and run the project. The backdoor installs a macOS LaunchAgent for reboot persistence and deploys a stage-2 loader plus C2 dependencies (socket.io-client, node-machine-id). The malicious code is entirely first-party; every installed npm package verified byte-identical to the official registry. The upstream Adamant-im/adamant-tradebot repository is clean and is a victim of repackaging. Trojanized private fork of the legitimate open-source project `Adamant-im/adamant-tradebot`. Distributed via fake job recruitment: the victim was offered employment, asked for their GitHub account, granted collaborator access, and instructed to set up and run the project. ## Kill chain **Loader** — `modules/configReader.js`, executed on every application start (`app.js` requires it at line 7): - Line 376: `eval(this.sessionData)` on attacker-controlled plaintext - Lines 63-75: hardcoded endpoint and credentials. Endpoint is base64-encoded to evade grep: `aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL09CQ0RL` decodes to `hxxps://jsonkeeper[.]com/b/OBCDK`. Auth header `x-secret-key: _` - Lines 314-326 fetch, 331-367 decrypt, 372-378 `eval()` - Encryption: `aes-256-cbc`, password `myPassword123`, salt `salt`, key `scryptSync(pw, salt, 32)`, IV = first 16 bytes - Lines 409-412: floating promise calls `process.exit(1)` on any network error to the unrelated host **Stage 1 (dropper)** — creates `$TMPDIR/Programs_X64/`, writes `main.js`, runs `npm init -y && npm install axios node-machine-id socket.io-client`, then spawns a detached child with `stdio: "ignore"`. **Stage 2** — fetches `hxxps://jsonkeeper[.]com/b/5UYI7`, same decryption scheme, `eval()`s result. **Stage 3** — not retrieved; endpoint returned HTTP 404 at time of analysis. Execution unresolved, treat as fully capable. ## Persistence macOS LaunchAgent `~/Library/LaunchAgents/com.MyNodeStartupScript.plist`, `RunAtLoad: true`, survives reboot. Observed running as PIDs 54615 and 54673. ## Malicious commit - SHA: `58b87031fd73f4b66276137d13dcd2d86b9fbdb0` - Author string: `adamantmm <cryptobatonidze@gmail.com>` (unsigned, `%G? = N`) - Claimed date `2026-08-10` is **forged** — hosting org was created `2026-09-11T02:13:53Z` - Commit message `chore: add .playwright-mcp to .gitignore` while actually deleting Docker support, the `mm` binary, and four modules, and rewriting 260 lines of `configReader.js` ## Upstream is clean — this is repackaging - Commit `58b8703` is absent from `Adamant-im/adamant-tradebot` (GitHub API: "No commit found for SHA") - Upstream `modules/configReader.js` contains zero kill-chain strings - The parent commit `fef2bf2` version of that file is **byte-identical** to live upstream (SHA-256 `a3e487ea0a2a982ce7a3d9b3d8f3d68f30ef08ddc6a424da256e307fa210244f`); the malicious version hashes to `c8ffffafb3b72bdeda8cb05216e936938c4932301f210d11f873029bac5b8596` ## Publisher GitHub account `adamantmm` (account ID `147433669`). The email `cryptobatonidze@gmail.com` is **verified on that account** — 187 public commits using it are all attributed to `adamantmm` by GitHub, which requires control of the mailbox. That account has 44 commits in the legitimate upstream `adamant-tradebot` (first contribution 2025-02-22, modifying `configReader.js`) and its profile advertises `hxxps://marketmaking[.]app`, the same domain this package names as its homepage. ## Packages 28 packages installed (3 direct, 25 transitive): `axios@1.20.0`, `node-machine-id@1.1.12`, `socket.io-client@4.8.4`. All verified **byte-identical to the official npm registry** (SHA-512 match against published `dist.integrity`). npm audit returned zero vulnerabilities. **No supply-chain compromise — the malicious functionality is entirely first-party code.** ## Observed impact Ran unattended ~90 hours (2026-10-14 13:17 to 2026-10-18 07:29). Contained and verified clean. Host credential exposure included a GitHub PAT and npm publish token in plaintext `~/.npmrc`, two `gh` tokens in keychain (one `admin:org`), and 7 SSH private keys.