GCVE-110-OSM-2026-4215

This package was originally published in May 2026 by the NPM user sirilkoondrei. That payload used the hard-coded IP address 8.217.75.147. That package was removed in Mid May, but evidentally no placeholder went up. Fast forward to September 16, 2026. A different NPM user juliam0819 published a package named hardhat-core on September 16 and it was removed from the NPM registry later that day. This time the package was published under version 2.1.2 and used a Vercel endpoint for its C2: ipcheck-hashed.vercel.app. September 2026 payload: This package is a confirmed stealer/dropper trojan impersonating the legitimate hardhat Ethereum tooling. The exfil file `lib/caller.js` is fully readable: it hardcodes base64-encoded values for a C2 URL (`https://ipcheck-hashed.vercel.app/api/auth/f1f097d93c318c92f0c5`), an API key header name (`x-secret-key`), and a header value, then POSTs to that C2 endpoint and executes the server response via `new Function.constructor('require', s)(require)` — a classic fetch-and-eval remote code execution pattern. The entrypoint `index.js` spawns `lib/caller.js` as a detached, stdio-suppressed child process that survives parent exit, ensuring the payload fires silently on any import of the package. The publisher account (`juliam0819`) is less than a day old with only this one package, and the OSV advisory (MAL-2026-3713) corroborates the typosquat-and-dropper attacker model; the actual code in this version shows a more sophisticated implementation than described in the advisory, but the adversarial intent is identical and unambiguous. May 2026 payload: Entrypoint: index.js (main: index.js) Payload: index.js Key findings: - Decoded Base64 Content in package.json - Shell Command Execution in package.json: "require('child_process')" - Curl/Wget Pipe to Shell in package.json: "curl -s '+d+'|bash" IOCs: - urls: https://sepolia.infura.io/v3/YOUR-KEY, http://8.217.75.147:3000/payload - domains: sepolia.infura.io - ips: 8.217.75.147 - payloadFileHash: 30de91d96a3135e6cb4db649e7f037bab8b45d25b27c33f6984783815543b6a8 Decoded/deobfuscated IOCs: - urls: http://8.217.75.147:3000/payload - ips: 8.217.75.147