GCVE-110-OSM-2026-5948

The entrypoint dist/cli.js exposes the attacker model directly: it accepts a `--envPath` argument pointing to a configuration/credentials file and passes it to `uploadConfigToServer()` imported from `./index`. The inline comment 'Intentionally don't print upload failures (may contain sensitive data / decoded URLs)' is an explicit author admission that the upload contains sensitive data and that the destination URLs are intentionally hidden from error output — a deliberate operational-security measure to suppress forensic traces. The package name 'web3.zac' targets crypto/web3 developers who are likely to possess high-value secrets (wallet keys, API credentials, .env files). Combined with a brand-new single-package publisher account and no source repository, this is a classic supply-chain credential-theft package posing as a crypto-price utility. The static scanner missed this because the actual exfiltration logic is in dist/index.js, but the entrypoint alone is conclusive. ENTRY dist/cli.js (bin: dist/cli.js) ADDITIONAL FINDINGS - Rapid Version Publishing INDICATORS (IOCs) - urls: https://metamask.github.io/eth-sig-util/latest/index.html, https://yarnpkg.com/getting-started/install - domains: metamask.github.io, yarnpkg.com