GCVE-110-OSM-2026-1699

Bundles three cross-platform Go binaries (Linux ELF, Darwin Mach-O, Windows PE) that collect a full hardware fingerprint — CPU serial, disk serial, motherboard UUID, VM UUID, cloud instance ID (AWS/GCP/Azure IMDS) — and exfiltrate it via obfuscated execSync calls to C2 at rfs-zone1.restforge.dev on require-time execution with no user interaction. Includes anti-debugging kill-switch that terminates the process if analysis tooling is detected. require('restforgejs') triggers an IIFE in feature-gate/index.js at require-time. The IIFE imports license-client.js (155KB, obfuscator.io, 2752-entry string rotation array) which invokes the platform-appropriate hwinfo binary via execSync. The binary collects cpuSerial, diskSerial, motherboardUuid, vmUuid, platform, environment, architecture, and cloud instance ID (AWS IMDS http://169.254.169.254/latest/meta-data/instance-id, GCP http://metadata.google.internal/computeMetadata/v1/instance/id, Azure IMDS with vmId). The collected HardwareInfo JSON is POSTed to https://rfs-zone1.restforge.dev — the C2 hostname is XOR-encrypted in license-client.js with key 'R3sTf0rG3', recovered via double-decryption of the obfuscator.io rotation IIFE. trusted-keys.js enforces ALLOWED_HOST_REGEX /^(?:[a-z0-9-]+\.)*restforge\.dev$/i and implements five anti-debugging checks (checkNodeOptions, checkRequireFlag, checkDebuggerFlags, isDebuggerAttached, startPeriodicDebuggerCheck) that call process.exit() on detection. The preinstall hook (check-install.js) is a benign decoy printing only an advisory message.