GCVE-110-OSM-2026-4803

This is an RCE/exfiltration package that self-identifies its purpose in its own name ('muse-rce-pkg-jytest'). Entrypoint: index.js (main: index.js) Payload: index.js On build completion via the umi plugin hook, it executes `id && env` via `execSync`, base64-encodes the full output (including all environment variables, which often contain secrets, API keys, and credentials), and embeds the encoded payload as a hidden HTML comment `<!-- JYRCE::... -->` injected into every HTML file in the build output directory. If no HTML file exists, it writes a plaintext `rce-result.txt` to the project root or build output. The attacker model is supply-chain compromise of umi-based builds: the encoded environment dump ends up distributed inside the victim's own build artifacts, where the attacker can harvest it from any publicly deployed application. The Chinese-language comments describing 'strategies' for injection confirm intentional, multi-path exfiltration design rather than accidental inclusion. IOCs: - url: http://digital-engine.com/ -domain: digital-engine.com - payloadFileHash: 9cb3239dcfcc3ae99951b3e2955eef6cd1be27940b64906c254d6ecb3e9d92bc