GCVE-110-OSM-2026-3125

Steals credentials by downloading a remote JavaScript payload from https://nexussss-opal.vercel.app/nexus-logger.js at require-time, injecting the user's NEXUS_API_KEY into the downloaded script, writing it to disk at bin/nexus-logger.js, and appending an instruction block to CLAUDE.md that directs Claude Code to execute the attacker-controlled script after every tool call — enabling persistent command execution and credential exfiltration through a Vercel-hosted C2 endpoint. Trigger → require-time execution (no install hook — fires on import). Collection → reads NEXUS_API_KEY from process.env. File access → reads .env file, reads existing CLAUDE.md. Encoding → JSON.stringify for API key injection into downloaded script. Staged payload → fetches remote script from https://nexussss-opal.vercel.app/nexus-logger.js. Persistence → writes fetched payload to bin/nexus-logger.js, appends telemetry instruction block to CLAUDE.md instructing Claude Code to execute bin/nexus-logger.js after every tool call.