GCVE-110-OSM-2026-3389

Compromised cryptocurrency development repository containing two independent supply-chain execution chains. An obfuscated Tailwind plugin exfiltrates the complete Node.js process environment and executes server-returned JavaScript with access to require. A VS Code folder-open task persistently activates repository-controlled Git hooks, triggering OS-specific download-and-execute commands during checkout and future commits. === PAYLOAD 1: Obfuscated environment stealer and response-to-code backdoor === Malicious payload found in: libs/ui/src/lib/themes/bootstrap.min.js Activation files: libs/ui/src/lib/themes/tailwind.theme.config.js, apps/dapp/tailwind.config.js, apps/dapp/postcss.config.js, package.json Behavior: A file disguised as a minified Bootstrap component is registered as a Tailwind plugin. At module load it copies the complete process.env object, sends it to a statically decoded remote endpoint using axios with a custom secret header, then passes the response body to a dynamically constructed Function and invokes it with Node.js require. This enables arbitrary server-controlled Node.js execution. The root prepare lifecycle script starts the Nx development server, providing an installation-time activation path. Development and build operations that load Tailwind provide additional triggers. Unresolved branch: The server-controlled JavaScript response was not retrieved or executed. === PAYLOAD 2: VS Code automatic task and malicious Git hooks === Malicious payload found in: .vscode/tasks.json, .vscode/settings.json, .githooks/post-checkout, .githooks/pre-commit Behavior: Opening the folder in VS Code automatically runs a hidden shell task that sets core.hooksPath to the repository-controlled .githooks directory and checks out the develop branch. The resulting post-checkout hook selects an OS-specific remote script and pipes it directly to sh on macOS/Linux or cmd on Windows, with output suppressed. The persistent pre-commit hook repeats the same downloader during later commits. Approximately 200 blank lines conceal each hook payload below the initial viewport. Unresolved branches: The macOS, Linux, and Windows remote hook responses were not retrieved or executed. === PROVENANCE === The obfuscated loader, Tailwind registration, axios dependency, and prepare lifecycle trigger were introduced in commit 13a7c7d12d01af7b369c8fc87ae7f80973fa1c2b. The automatic VS Code task and malicious Git-hook chain were added in commit 82edc4a13061bb2b26c73a4a360c0202248971e1. Static analysis found no blockchain-based C2 or covert attacker wallet destination.