GCVE-110-OSM-2026-14010

PRIVATE lure repository ("VaultX RWA dApp", React/Vite + Solidity presale) used in a fake recruiter / "contagious interview" campaign on Upwork. The repository is private and not publicly visible; the reporter was given access to it with a personal GitHub account as part of a paid "test task", with a request to urgently review it and estimate schedule/budget. Keeping the repo private and granting access per-victim hides it from public scanners. The reporter holds a full local clone (all branches, tag v1.0.1, complete history) and can provide it (git bundle / archive) on request. Delivery mechanism: the repo's .npmrc sets `registry=https://register-security.vercel.app/`, and package-lock.json resolves vite@8.3.1 to https://register-security.vercel.app/-/tarballs/dml0ZQ/8.3.1.tgz with integrity sha512-NPLv29tKoSvZXFmqnT1f... (official npm vite@8.3.1 is sha512-/bvH9E9tmCXRGp2uXY3W...). All other 158 dependencies resolve to registry.npmjs.org. The included Tasks.pdf (AI-generated, C2PA metadata from OpenAI dated 2026-10-07) requires every role (SC/FE/BE) to run `npm install`, start the frontend, and connect a funded crypto wallet. Application source contains no obfuscated code — the payload is delivered solely through the swapped dependency. Commit history is synthetic: 324 commits but only 118 distinct trees, each file added once and never modified, generic commit messages, 7 branches with identical content. Commit authors: Ayub Ng'ang'a <Ayubngash7@gmail.com>, Pranshu Jain <pranshujain0111@gmail.com>, Adnan Bardgujar <adnanbardgujar@gmail.com> (may be fake or impersonated). HEAD/main: f3eaf88ddfd054099ea2c547a943c68fff5d6cf1. ~22 freelancers in interview stage, 60 invites sent at the moment on Upwork. (18:21 CET, 21 Oct 2026) No payload in repository source. Delivery vector: .npmrc (registry=https://register-security.vercel.app/) + package-lock.json entry for vite@8.3.1 resolved to https://register-security.vercel.app/-/tarballs/dml0ZQ/8.3.1.tgz (sha512-NPLv29tKoSvZXFmqnT1fiothoIU5CxnbZmxVyFQIGabyfcFMHSPpsB01ohMKpt7us+EgNoGEtiWh3HAqRZ6UaA==). Triggered by `npm install` / `npm run dev`.