GCVE-110-OSM-2026-3171

Harvests cryptocurrency wallet data by querying TRON, Aptos, and Binance Smart Chain APIs with hardcoded attacker-controlled addresses, then executes a stage-2 Node.js payload retrieved from BSC transaction input fields via child_process.spawn. src/index.js copies the legitimate tailwindcss-animate plugin verbatim and appends a character-shuffle obfuscated IIFE after 600+ chars of whitespace (sha256: 1e2b29888c522c6a34ccc3e2b3239501072a8d67f08a7fd2e441fbeb614c3809). Decoded payload (js_solver rule: character-shuffle-sfl, 57 strings) executes at require-time via Function constructor: queries api.trongrid.io with attacker TRON addresses TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP and TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG for confirmed outbound transactions, queries fullnode.mainnet.aptoslabs.com for Aptos account activity, calls eth_getTransactionByHash on bsc-dataseed.binance.org (fallback: bsc-rpc.publicnode.com) using BSC transaction hashes 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e and 0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3, and executes retrieved payloads via child_process.spawn('node', ['-e', payload]) up to 5 times with stdio ignored. Spoofs author identity (me@thejameskyle.com) to impersonate legitimate JS developer Jamie Kyle.