GCVE-110-OSM-2026-13930

casamare is a malicious npm package masquerading as an Angular helper SDK for real-estate listing workflows. Version 1.0.0 conceals a heavily obfuscated browser payload inside a file falsely presented as a Protocol Buffers asset. If a consuming application decodes and executes that asset, the payload steals authenticated user and administrator session material, inventories browser storage and accessible cookies, fingerprints the victim environment, and sends the collected record to an external data store. It also injects hidden dofollow links from a large SEO-spam list into listing descriptions and deliberately suppresses a deterministic subset of clicks, pointer events, form submissions, and keyboard interactions. Importing the package alone does not execute the concealed payload; execution requires the purported asset to be loaded, decoded, and placed into a browser execution path. The malicious payload is stored in both src/assets/5760.pbf and dist/assets/5760.pbf. Both files are identical 313,604-byte ASCII JavaScript programs despite being labeled application/x-protobuf. The package's CasamareListingService reads the asset as Base64 and returns it with the false protobuf media type. The payload uses a 3,900-entry encoded string table, a nonstandard Base64 alphabet, a 491-position array rotation, decoder aliases, wrapper functions, and control-flow indirection. Once executed in a browser, it checks localStorage for cm_access, cm_refresh, cm_user, propex_admin_token, propex_admin_refresh, and propex_admin_user. If recognized authentication or profile data exists, it collects the user ID or email, public and administrator access and refresh tokens, parsed profile data, most localStorage and sessionStorage entries, non-analytics cookies, origin, page URL, referrer, user agent, language, platform, timezone, WebDriver state, screen and viewport dimensions, hardware concurrency, device memory, and network connection metadata. It conditionally uses the public access token to request the authenticated user's listing count from a same-origin API. It separately queries a legitimate public-IP service and adds the returned IP address and inferred IP version to the stolen record. The record is then sent by an authenticated JSON POST with keepalive enabled to an attacker-operated Supabase table. A Base64-encoded cm_tracking_state value records the user key and a signature derived from the token set, suppressing repeat transmission until the user or token material changes. In parallel, the payload contains 1,009 external spam URLs, randomly selects 10 to 30, and injects them as rel=dofollow anchors inside off-screen cm-links containers attached to listing-description elements. A MutationObserver and hooks for history.pushState, history.replaceState, and popstate restore the injected links following DOM mutations or single-page navigation. Capture-phase listeners monitor click, pointerdown, submit, and keydown events. A seeded hash selects approximately one-sixth of matching controls and blocks those interactions with preventDefault, stopPropagation, and stopImmediatePropagation, creating intermittent application failures. Static analysis found no subprocess execution, native binary, filesystem persistence, secondary executable download, response-to-code path, eval-based stage, blockchain activity, WebSocket channel, Telegram bot, or Discord webhook. The two GET response paths return JSON only and are not evaluated or written as executable content. The 1,009 spam destinations are embedded references and are not directly fetched by this payload; they remain unconfirmed third-party infrastructure.