GCVE-110-OSM-2026-14396

Import-triggered npm supply-chain package implementing credential theft, cloud-account abuse, repository propagation, persistence, blockchain-based task retrieval, and execution of remotely supplied JavaScript. The code has high-risk capabilities, while its embedded private/loopback relay configuration and explicit simulation markers leave operational campaign status unconfirmed. Malicious payload found in: personas.mjs -> cache-warm.mjs, with additional stages in build-cache.mjs, workspaces.js, cache-sweep.mjs, and platform-specific native cache-probe.node modules. A normal package import reaches an XOR/Base64-obfuscated loader without requiring an npm lifecycle hook. The stages search environment variables, cloud and developer configuration, Git remotes, SSH material, private keys, browser/login files, and source workspaces. Discovered AWS credentials can be used with STS, IAM, Bedrock, and invoicing APIs. Persistence and propagation paths create detached Node processes, cron reboot entries, PATH/node/curl shims, modify sibling repositories, amend commits, force-push, expire reflogs, and run garbage collection. Blockchain tasking reads encrypted JavaScript from TRON transaction data, account transaction arguments, and EVM/BSC transaction input, then XOR-decodes and executes it through eval and a detached Node process. A recent-block branch interprets recipient-address bytes as relay IPs, ports, and routing data, consistent with NullReceiver, while transaction-data payload retrieval is EtherHiding-like. Six native modules perform VM, container, and sandbox checks. The embedded relays are private or loopback and the source contains explicit lab/simulation markers, so live infrastructure and attribution are unresolved.