GCVE-110-OSM-2026-14736

Legitimate, established package whose release automation account appears to have been compromised. Version 13.3.0 was published through the project's real release workflow from an unreviewed commit that added an install-time hook, and only that version is affected. It was removed from npm about 75 minutes later. On install, the hook fingerprints the operating system, fetches code from an attacker-controlled server and runs it with full Node.js privileges. The later stages steal the Bee node password and wallet key and install a persistent remote access backdoor. About 30 minutes after the npm publish, the same account published a malicious release of the project's Swarm Desktop app that contacts the same server, so the two releases are one incident. The command-and-control design, an Ethereum contract that tells the malware where to connect, matches the SleepyDuck campaign. ENTRY scripts/generate-version.cjs (install-hook: node scripts/generate-version.cjs) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Collection in scripts/generate-version.cjs: "process.platform" ADDITIONAL FINDINGS - dep-known-malicious in package.json: "debug" - Dynamic Code Execution in scripts/generate-version.cjs: "new Function('require', 'console', 'process', body)" - Suspicious TLD Domain in scripts/generate-version.cjs: "hxxps://api[.]frameworkmetrics[.]xyz" - Malicious Dependency Detected in package.json PAYLOAD FILES scripts/generate-version.cjs ## Payload 1: postinstall loader Malicious payload found in: `scripts/generate-version.cjs` - Trigger: in 13.3.0 the `prepare` script in `package.json` was renamed to `postinstall` (`node scripts/generate-version.cjs`). No earlier version of the package has an install-time hook. It runs by default on npm 11 and earlier, Yarn Classic and Yarn Berry before 4.14.0. npm 12, pnpm 10+, Yarn Berry 4.14.0+, Bun and Deno skip dependency install scripts by default. - Behavior: HTTPS GET to `hxxps://api[.]frameworkmetrics[.]xyz/v1/analytics` with `User-Agent` set to `process.platform` and an `X-Ethersphere: 1` header, then the response body is run with `new Function('require', 'console', 'process', body)`. There is no environment, CI, locale or time check, and the response status is not checked. Without the `X-Ethersphere` header the server returns a decoy. - Stage 2: the server returns JavaScript per operating system. It posts the Bee node `config.yaml` (plaintext password) and `data-dir/keys/swarm.key` (encrypted Ethereum keystore) to `hxxps://api[.]frameworkmetrics[.]xyz/v1/swarm/report`, then downloads stage 3 from `/v1/assets/` on the same host. ## Payload 2: stage 3 backdoor Malicious payload found in: platform binaries written to `~/.solidity/` (for example `linux_amd64`, `darwin_arm64`) and `invoke.ps1` on Windows - macOS and Linux: a Go backdoor (module `evjawbreaker`) started by `~/.solidity/.run.py` (or `.run.cjs` on macOS when Node.js is present). Persistence is the systemd user unit `solidity-langsupport-runner.service` or the LaunchAgent `com.solidity.langsupport.runner`. It exits if a debugger or VM is detected. It reads its hub address from an Ethereum contract through the public RPC gateways `rpc[.]ankr[.]com` and `cloudflare-eth[.]com`, connects to the hub on port 4912 over TLS without certificate validation, and runs operator commands in a persistent `sh` pty. - Windows: an obfuscated PowerShell loader (`invoke.ps1`) stages files under `%TEMP%\.stuffed-*`, bypasses UAC with UACME method 39 (COR_PROFILER against `mmc.exe`), adds a Microsoft Defender exclusion, and silently installs ConnectWise-signed ScreenConnect 25.4.3 configured for the relay `185[.]232[.]84[.]169:8041` with the tray icon and banners hidden. It runs as the SYSTEM service `ScreenConnect Client (5cbe79c9c25524df)`. - C2 configuration: the hub address and payload URL are stored on an Ethereum mainnet contract that only the operator wallet can change, so the hub moves without changing the package.