GCVE-110-OSM-2026-6307

This package is part of the Graphalgo campaign, an ongoing npm supply chain operation running since at least March 2026. It shares C2 infrastructure — an Ethereum Sepolia smart contract, Slack channels, and Telegram bot — with over 20 other malicious packages in the campaign. Malicious code executes at runtime inside the package's own prototype method rather than via a lifecycle install script, bypassing npm v12's lifecycle script restrictions. As of September 2026, campaign operators had accumulated approximately 109 ETH. ## Trigger Malicious code is embedded in the package's main prototype setter (e.g., `BTree.prototype.set`). When invoked with a specific key value, it spawns a detached `node` process running the obfuscated first-stage loader (`extended/sharedLoad.min.js`) with `stdio: "ignore"` and `windowsHide: true`. No postinstall hook is used. ## First stage The loader fingerprints the host (OS, architecture, hostname, CPU count, memory, uptime) and exfiltrates to: - Slack channel `C0B8XPGCKQS` via embedded `xoxb` bot token - Telegram chat `-1003952553968` via bot `8961878831` It then connects to Ethereum Sepolia via `hxxps://eth-sepolia[.]g[.]alchemy[.]com/v2/D2-TbkB2m05WXSnSDOCDI` and `hxxps://sepolia[.]infura[.]io/v3/dc7257d09fab42eca2c354c32fec1938`, reads encrypted blobs from smart contract `0xE390863Dac96a7118C71227C2b099B50cF602D31`, performs X25519 ECDH key exchange using hardcoded TA public key `bad013df6eec5d686f4cc8551e0a5c87a0135164bdd1dafb1c75141d1b526702`, decrypts and executes the second stage. ## Second stage A Slack polling agent checks `slack[.]com/api/conversations.history` every 10 seconds using a second embedded `xoxb` bot token (channel `C0B8GEPFMK9`), decrypts chunked operator messages using AES-GCM/PBKDF2, reassembles them into `~/subwatcher`, and executes it — providing persistent remote command execution. The loader then self-deletes and strips the trigger from the prototype.