GCVE-110-OSM-2026-5272

This package implements a covert AI cheating assistant that operates with explicit stealth design: the main window uses `-transparentcolor 'white'` and `overrideredirect(True)` to be invisible, hotkeys are bound to hide/show on Escape and backtick, and the process runs silently with `stdio: 'ignore'`. The Python payload in `client/noderzero.py` continuously monitors the clipboard via `pyperclip.paste()`, captures screenshots via `ImageGrab.grab()`, and exfiltrates base64-encoded data to the hardcoded C2 endpoint `https://server-mng5.onrender.com/api`. The description explicitly calls itself a 'Stealth Assistant' and the code comments confirm the attacker model: intercepting clipboard content during coding assessments/interviews and relaying it to a remote AI backend, with the response displayed invisibly. Five versions published within 40 minutes from a brand-new account reinforces active development and evasion refinement. Entrypoint: launcher.js (bin: ./launcher.js) Exfil: https://server-mng5.onrender.com/api (custom-c2, recovery: plaintext in client/noderzero.py) Payload: client/noderzero.py Secondary files: launcher.js Key findings: - Data Encoding for Exfiltration in client/noderzero.py: "base64.b64encode(" - Clipboard Access in client/noderzero.py: "pyperclip.paste()" - Shell Command Execution in launcher.js: "require('child_process')" - Silent Process Execution in launcher.js: "stdio: 'ignore'" - Brand New Package IOCs: - urls: https://server-mng5.onrender.com/api - domains: server-mng5.onrender.com - payloadFileHash: 9d348ca9c62772d67618e840c87fd165910c0328f1feb50e10107614b3931e88