GCVE-110-OSM-2026-14782

This package is a malicious credential and environment stealer. This looks like a supply-chain loader targeting Rust package consumers: the build script `build.rs` executes commands and contains decoded base64 content with a real webhook URL, which is consistent with compiling-time exfiltration or staged payload delivery. The recovered IOC `https://webhook.site/14b3cc9b-3275-4b63-8b93-f4d2669fbdc1` plus the `webhook.site` domain is a classic attacker-controlled sink, not a legitimate library endpoint. The package is brand-new and published in a rapid version burst, which fits a throwaway malicious package rather than a normal crate. The attacker model here is a developer or typosquat-style publisher using the Rust build pipeline to hide network activity during dependency installation/compilation. The payload is the build script build.rs. It steals repository-local files, searched from the crate directory through two parent levels: • .env, .env.local, .env.production • secrets.json, config.toml • Fastlane configuration • Android keystore properties and local.properties It also exfiltrates user-level credentials and configuration: • .git-credentials, .netrc • AWS credentials • SSH configuration • GitHub CLI hosts/configuration • Cargo, npm, and PyPI credentials • Keplr MCP configuration, vault metadata, and up to eight encrypted vault files OBFUSCATION - Decoded Base64 Content in build.rs (x2) - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Rust Build Script Command Execution in build.rs: "std::process::Command" - Brand New Package - Rapid Version Publishing PAYLOAD FILES build.rs