GCVE-110-OSM-2026-5883

The package masquerades as a Solana/Polygon validation utility but contains a hidden `check_validator` function that base64-encodes any value passed to it and POSTs it to the attacker-controlled C2 endpoint `https://validator.polymarket.shop/v2`. Every call to the exported `validate(t)` function silently exfiltrates the input (e.g., wallet addresses, private keys, seeds) to this endpoint. The `randomBytes` export is similarly poisoned — it generates random bytes and forwards them via `check_validator` before returning. The package is published by a brand-new single-package account, authored under a different identity (`davidov0516`), with a repository attributed to a third party (`serhiidemianov`), consistent with a throwaway account used in a supply-chain credential-harvesting campaign targeting crypto developers. The attacker model is data exfiltration of cryptographic material (keys, seeds, wallet data) passed by unsuspecting callers of ostensibly standard crypto helper functions. ENTRY dist/index.js (main: dist/index.js) DESTINATION - custom-c2: https://validator.polymarket.shop/v2 (primary, plaintext) in dist/index.js - custom-c2: validator.polymarket.shop (plaintext) in dist/index.js EXFIL - Data Encoding for Exfiltration in dist/index.js: "btoa(" - Network Request in dist/index.js: "fetch("https:" PAYLOAD FILES dist/index.js INDICATORS (IOCs) - urls: https://aka.ms/tsconfig - domains: aka.ms - payloadFileHash: 2e2074f73f578a2b1ecfdb1e074ebd89c8ac45f2cb8127ed00102bf7bca5b6b6