GCVE-110-OSM-2026-14302

Malicious npm package linked to the PolinRider and UNC5342 software supply-chain campaign. Importing the package immediately activates an obfuscated multi-stage loader without requiring an npm lifecycle hook. The chain uses blockchain transaction calldata as an immutable dead drop to deliver JADESNOW, an INVISIBLEFERRET remote-access trojan, and a cross-platform credential stealer. The malware enables arbitrary command execution and theft of browser, cryptocurrency-wallet, developer, password-manager, cloud-storage, and operating-system credentials. ENTRY index.js (main: index.js) The malicious code is appended to the package entry point after legitimate utility exports and executes whenever the package is imported. It sets the campaign marker "5-itsa", queries BNB Smart Chain transaction history through a blockchain explorer, and extracts encoded transaction input. The initial loader removes the transaction input prefix, decodes the hexadecimal data, extracts a Base64 value, and decrypts it using repeating-key XOR. It then runs the recovered JavaScript in a detached Node.js process. Errors are silently discarded. The first recovered stage is JADESNOW. It uses redundant Ethereum explorer services to retrieve encrypted JavaScript from transaction calldata. This is an EtherHiding delivery mechanism: executable payloads are stored directly in blockchain transaction input rather than encoding a server address in the transaction recipient. JADESNOW recovers a split INVISIBLEFERRET bootstrapper. The bootstrapper checks the victims geolocation and exits if the country code is RU. It reports victim status to an attacker-controlled HTTP service, installs missing Node.js dependencies, and attempts to provision Python 3.12.7. It can download portable Python archives, an extraction utility, and supporting environment files from the same server.