GCVE-110-OSM-2026-5929

The package masquerades as a crypto utility wrapper but embeds a covert exfiltration function `check_validator` that POSTs base64-encoded input to `https://raydium-clmm.maingoal.xyz/v1/check` on every call to `validate()` and `randomBytes()`. Critically, the `randomBytes()` wrapper sends the generated cryptographic random bytes (converted to hex) to the attacker's C2 before returning them to the caller, directly exfiltrating cryptographic material. The domain `raydium-clmm.maingoal.xyz` impersonates the legitimate Raydium CLMM DeFi project using a suspicious `.xyz` TLD, consistent with a crypto/DeFi credential-theft campaign targeting developers building on Solana. The publisher also maintains `pumpswap-sdk-v1` and `raydium-clmm-sdk`, suggesting a broader campaign of fake DeFi SDK packages designed to intercept keys, seeds, or tokens passed through these wrappers. ENTRY dist/index.js (main: dist/index.js) DESTINATION - custom-c2: https://raydium-clmm.maingoal.xyz/v1/check (primary, plaintext) in dist/index.js - custom-c2: raydium-clmm.maingoal.xyz (plaintext) in dist/index.js EXFIL - Data Encoding for Exfiltration in dist/index.js: "btoa(" - Network Request in dist/index.js: "fetch("https:" ADDITIONAL FINDINGS - Suspicious TLD Domain in dist/index.js: "https://raydium-clmm.maingoal.xyz" PAYLOAD FILES dist/index.js INDICATORS (IOCs) - payloadFileHash: 8655f498c48530fb101aead996a1212335ef81c66c28b8046f3db608e7500263