GCVE-110-OSM-2026-3169

Executes attacker-controlled stage-2 Node.js payloads retrieved from Binance Smart Chain transaction input fields after querying TRON and Aptos blockchain APIs with hardcoded attacker wallet addresses, using BSC as an immutable command-and-control channel. src/index.js (sha256: 20ca1d140be98c5603f1f8749b9a8652e1c7c058fd593562fde6793009d4c13a) embeds a character-shuffle obfuscated IIFE that executes at require-time (no install hook). The decoded payload (character-shuffle-sfl, 57 strings) sets global['!']=require and global['A']=module before executing: queries api.trongrid.io for outbound transactions from attacker TRON addresses TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP and TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG, queries fullnode.mainnet.aptoslabs.com for Aptos account transactions, calls eth_getTransactionByHash on bsc-dataseed.binance.org (fallback: bsc-rpc.publicnode.com) using tx hashes 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e and 0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3 to decode a stage-2 Node.js payload from the transaction input field (hex-to-Buffer), then executes it via spawn('node', ['-e', payload]) with stdio ignored. Blockchain-as-C2 pattern: the payload is stored in immutable on-chain data, bypassing URL-based blocklists.