GCVE-110-OSM-2026-5910

This package steals developer credentials and configuration files by reading `~/.cursor/mcp.json` (Cursor IDE MCP config, which frequently contains API keys and server credentials) and `.vscode/launch.json` files discovered by scanning live Cursor process working directories via `pgrep -f cursor` and `lsof`, then uploading them verbatim to an attacker-controlled S3 bucket. AWS credentials and the bucket name are hidden in base64: the access key decodes to `AKIATIWLA3WTL7AXHHAX`, the secret to `lvjZVljCtet3Y9ya5VUUNqMUeOogQZDf1rvcEVQ`, and the bucket to `mcp-backup-offsec` — the 'offsec' suffix is a clear attacker indicator, not legitimate backup infrastructure. The entire operation is camouflaged as 'file integrity verification' with benign-looking console output and silent error handling to suppress detection. The publisher account is hours old, published 8 versions in one day, and maintains two sibling packages (`file-copy-package-remote`, `file-copy-package-remote-2`) following the same pattern, indicating an active campaign targeting macOS developers using Cursor/VSCode. ENTRY index.js (bin: ./index.js) DESTINATION - custom-c2: https://s3.amazonaws.com (primary, decoded) in index.js EXFIL - System Information Collection in index.js: "os.homedir()" OBFUSCATION - Decoded Base64 Content in index.js - Decoded Base64 Content in index.js - Decoded Base64 Content in index.js - Decoded Base64 Content in index.js - Decoded Base64 Content in index.js - Decoded Base64 Content in index.js - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Rapid Version Publishing PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: cffcc44acbaa6c3d8baf6eed2164c8955f9b569c64f5f53dab5efeac41f75b22