GCVE-110-OSM-2026-6135

Drops a platform-specific binary (Windows PE, Linux ELF, macOS Mach-O) at npm install time by fetching it from an adversary-controlled GitHub release repository (Monopoly63/mobile-bot). The installer hook executes the binary immediately via execSync and installs a hablas-shim.js that re-executes it on every subsequent CLI invocation. The package's dist/index.js (P0 jigsaw proofs confirmed) harvests AI provider API keys (HABLAS_API_KEY, BRAVE_API_KEY, BRAVE_SEARCH_API_KEY) from the environment, base64-encodes them, and exfiltrates them via HTTP. Stage-2 capabilities of the dropped binary are unknown — the GitHub release was removed (404) before payload recovery. postinstall.js downloads a platform-specific binary from https://github.com/Monopoly63/mobile-bot/releases/download/v2.5.2/{hablas-win-x64.exe|hablas-linux-x64|hablas-macos-x64}, verifies checksum, sets chmod 0755, and executes it via execSync. bin/hablas-shim.js re-executes the binary via spawnSync on CLI invocation or falls back to require(dist/index.js). dist/index.js (507KB, custom-alpha-base91, deobfuscation partial): P0 proofs for RCE and data_exfiltration; collects HABLAS_API_KEY, BRAVE_API_KEY, BRAVE_SEARCH_API_KEY from process.env, base64-encodes values, and exfiltrates via HTTP (endpoint not recovered — solver yielded 0 decoded strings). Binary payload capabilities unknown — GitHub release removed at analysis time.