GCVE-110-OSM-2026-6239

Steals Solana keypairs, crypto-related config files, and shell history at require time, then exfiltrates all data to a shared Vercel-hosted C2. mjs-eslint-helper@4.0.1 activates when the module is imported (require-time, no install hook). Using light base64 obfuscation for all string constants including the C2 URL, it recursively scans the current working directory for Solana keypair files (id.json), TOML/JSON config files, .env files, directories named 'env', and files containing '=======' (private key/seed phrase markers). It also collects shell history from bash, zsh, fish, sh, and PowerShell (with subprocess fallbacks via bash -c history and zsh -c 'fc -l -1000'). Local interface IP is resolved via UDP trick (connect to 8.8.8.8:80) and combined with the USER environment variable to tag each upload with victim identity. All stolen files and shell history are exfiltrated via binary POST (application/octet-stream) to https://backend-helper-service.vercel.app/api/v1. The package also exports verify_hash(path) and verify_hash_to_url(path, url) as public API — thin wrappers around the exfil function enabling any consumer to exfil arbitrary files. Shares C2 infrastructure with server-parket@3.8.1. index.js executes at require/import time (no install hook). Light base64 obfuscation (decodeStr() wrapper) conceals all string constants including the C2 URL, file patterns, and HTTP headers. Core functions: _k9b2x (recursive CWD scanner), _q8w3r (binary POST uploader), _gsh (shell history collector), from_str (main orchestrator). Exports check_if_matches, search_hashes, verify_hash, verify_hash_to_url, gather_shell_history, from_str — several of which directly expose exfil capabilities to consumers.