GCVE-110-OSM-2026-14301

Malicious npm package linked to the PolinRider and UNC5342 software supply-chain campaign. Importing the package immediately activates an obfuscated multi-stage loader without requiring an npm lifecycle hook. The chain uses blockchain transaction calldata as an immutable dead drop to deliver JADESNOW, an INVISIBLEFERRET remote-access trojan, and a cross-platform credential stealer. The malware enables arbitrary command execution and theft of browser, cryptocurrency-wallet, developer, password-manager, cloud-storage, and operating-system credentials. ENTRY lib/component.jsx (main: ./lib/component.jsx) PAYLOAD webpack.config.js DESTINATION - 2 exfil (bitcoinAddresses, ethereumAddresses) (values recorded in verified_iocs)