GCVE-110-OSM-2026-13898

The package falsely presents itself as an Ethereum/ERC-20 library. Its README claims to create private accounts, one-time public addresses, transfers, transaction hashes, and “real” block records, but the implementation never connects to Ethereum or any blockchain. Instead, it generates invalid pseudo-wallet credentials and simulates all balances, transfers, hashes, and blocks as records in a hard-coded remote MySQL database. The package sends generated credentials to that database, stores private keys in plaintext, and credits simulated gas fees to a fixed operator account. Its supposedly one-time addresses can also be reused; the recovered database shows one such address receiving four transfers. This is a centralized counterfeit cryptocurrency system, not an Ethereum implementation. ENTRY main-ethers.js (main: main-ethers.js) The `bethers.js` file is heavily obfuscated, but when we deobfuscated that file, we recovered a hidden Clever Cloud C2/exfil domain that was actually a MySQL endpoint being used as an attacker-controlled data sink, consistent with credential/wallet harvesting operations seen in this campaign. The entrypoint `main-ethers.js` uses a computed global require alias (`module[a0_0x2c29a1(0x147)+'ts']=require`) to obfuscate dynamic loading of other malicious modules. OBFUSCATION - Obfuscation: augmented proxied array function replacements in bethers.js - Obfuscation: augmented proxied array function replacements in ethers3.js - Obfuscation: augmented proxied array function replacements in main-ethers.js - Obfuscation (osm-deobfuscator): obfuscator-io in bethers.js - Obfuscation (osm-deobfuscator): obfuscator-io in ethers3.js - Obfuscation (osm-deobfuscator): obfuscator-io in main-ethers.js - String Array Obfuscation in bethers.js: "['ycbdsee','z2v0q28','BwLZzq','z2Pbmhq','t1qGrvG','ihv0zJG','mtK1CvD0DLbZ','mta4..." - String Array Obfuscation in ethers3.js: "['DhHiyxm','ihbHCMu','ChvIBgK','sw52ywW','zgvFy2K','ieTfwsa','vcb0lMK','AxzLlG',..." (+6 more) ADDITIONAL FINDINGS - Global Require Alias in main-ethers.js: "module[a0_0x2c29a1(0x147)+'ts']=require" - Very New NPM Publisher Account - Rapid Version Publishing - Campaign marker: Contagious Interview Malicious Dictionary in ethers3.js: "_0x28aa" PAYLOAD FILES main-ethers.js (+ ethers3.js, bethers.js)