GCVE-110-OSM-2026-14819

This package pretends to be the legitimate NPM package "redeem-onchain-sdk". The malware employs multi-layer obfuscation (AES-256-CTR + XOR) to hide its malicious functionality and performs credential theft targeting sensitive configuration files, followed by the exfiltration of encrypted data to a remote C2 server. Payload: dist/index5_test.js Key findings: 1. This malicious package steals these environment Variables: - .env - .home/.env - .home/.aws/credentials (AWS) - .home/.docker/config.json (Docker registries) - .home/.ssh/id_rsa (Private SSH keys) - .home/.ssh/config (SSH configuration) - .home/.netrc (Network authentication) - .home/.npmrc (NPM configuration) - AppData/ssh/known_hosts (Windows) - LocalAppData/Google/Chrome/User Data/Default/Login Data (Windows Chrome passwords) - /tmp/session_temp.json (Unix temporary sessions) 2. This malware writes to a local log file, .redeem_err.log 3. Also writes an SSH public key to the local home directory of the compromised user 4. After installation, the malware overwrites the package.json file with a benign version to hide its tracks. The payload file used the same "OrDeR_7077" encryption key as the Axios payload, and the internal number string 4.2.1, which was the same version used by the Axios payload package, plain-crypto-js. IOCs: - urls: https://18.208.244.120:9999 - ip: 18.208.244.120 - file: .redeem_err.log - payloadFileHash: ea0d611711059f0d905e97878f05f6e887e71eadbfc783809e5a949bf89e6821