GCVE-110-OSM-2026-5760

This package is a Chrome infostealer disguised as a CLI utility. The entrypoint explicitly imports and exposes modules for extracting saved passwords, credit cards, autofill addresses, cookies, browsing history, and local storage — the canonical infostealer data set. The Windows-specific `dist/src/core/platform/win32.js` contains dynamic base64 decoding (`Buffer.from(y,"base64")`) and deobfuscation revealed 16 hidden strings, consistent with obfuscated exfiltration logic targeting the Windows credential stores. The dependency `chalk` is flagged as a known malicious package on OpenSourceMalware.com, and it is actively imported in the entrypoint (`import i from "chalk"`), meaning the compromised chalk version executes in the same runtime. Persistence signals across multiple files (`.profile`, `.PROFILE`) suggest an attempt to survive reboots, and the package was iterated rapidly (12 versions in ~2 weeks) with no source repository, consistent with active malware development. Entrypoint: dist/bin/cli.js (bin: ./dist/bin/cli.js) Payload: dist/src/core/platform/index.d.ts Secondary files: dist/src/core/platform/index.js, dist/src/core/platform/win32.js Key findings: - Startup Persistence in dist/bin/cli.js: ".PROFILE" - Startup Persistence in dist/src/core/chrome.js: ".profile" - Dynamic Base64 Decoding in dist/src/core/platform/win32.js: "Buffer.from(y,"base64")" - Startup Persistence in dist/src/modules/bookmarks.js: ".profile" - Startup Persistence in dist/src/modules/local-storage.js: ".profile" IOCs: - payloadFileHash: dcdc2eaae69bb8a2a64c437f8bf2c3f8d8918eb6d56e48b2a0a23620673f12eb