GCVE-110-OSM-2026-5722

APT malware detected: chai-max. Associated with threat actor(s): DPRK/Lazarus. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. Entrypoint: dist/utils.js (install-hook: node dist/utils.js) Exfil: https://huggingface.co/api/repos/create (reconstructed, recovery: reconstructed in dist/payload.js) Payload: dist/payload.js Key findings: - Cryptocurrency Wallet Theft in dist/payload.js: "wallet.dat" - Download Execute Delete Pattern in dist/payload.js: "writeFileSync(jsPath, buffer); logger_js_1.logger.info({ version: remo..." - Chai-Max Wallet Theft Indicators in dist/payload.js: ".exodus" - Reconstructed Obfuscated URL in dist/payload.js: "https://huggingface.co/api/repos/create" - Stealth Background Process Spawning in dist/utils.js: "spawn(process.execPath, [script, "--bg"], { detached: true, stdio: "..." IOCs: - ipv4: 4.0.0.0 - domains: matteocollina.com, Crypto.com, huggingface.co - emails: hello@matteocollina.com - urls: https://huggingface.co/api/repos/create - payloadFileHash: 10f41901a3e5da8a9d1f64d6dd3ac504afbb4b1e43eae4635fea189c8a7d1727