GCVE-110-OSM-2026-2089

This package installs a malicious dependency: @dany47/csec-crypto-utils which then downloads and runs malware Payload: package.json This package pulls the @dany47/csec-crypto-utils package which then downloads and installs the malware. IOCs - C2 Domain: csec-supply-chain-attack-1tcq.onrender.com — HTTPS exfiltration endpoint - C2 URL: https://csec-supply-chain-attack-1tcq.onrender.com/e — POST endpoint for data exfiltration - Package Name: csec-crypto-toolkit — malicious npm package - Package Version: 4.2.1 — specific version containing malware - Malicious File: setup.js — obfuscated payload executed on install - XOR Key: OrDeR_7077 — hardcoded deobfuscation key - XOR Constant: 333 — secondary XOR value for payload decryption - Author: csec-demo — package metadata author field - Execution Method: postinstall script — automatic execution trigger - File Hash: a72916ef7807b1493d8251cf86bc0ace38d6b7e2e5f7295f193d75a72a9b360f