GCVE-110-OSM-2026-6515

This package is a credential-theft and data-exfiltration tool. The postinstall hook (test.js) invokes from_str_1/2/3/4 from index.js on install, which recursively scans the filesystem for .env files, wallet-related documents, shell history, and other sensitive files, then uploads them via multipart POST to the attacker-controlled C2 at https://vercel-backend-five-vert.vercel.app/api/v1 using axios. The code explicitly targets Linux home directories, Windows drive letters C-J, and macOS /Users, collecting crypto wallet keywords (mnemonic, privatekey, seed, metamask, phantom), .env files, and config files. The publisher 'polyx' has a 55% malicious package ratio with 5 confirmed malicious packages (eslint-helper-1, new-ecro-1, new-eslint-1, new-mjs-eslint, new-ts-helper) from the same burner account created 4 days ago, establishing a clear pattern of supply chain attack infrastructure. ENTRY test.js (install-hook: node test.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://vercel-backend-five-vert.vercel.app (primary, plaintext) in index.js - custom-c2: vercel-backend-five-vert.vercel.app (plaintext) in index.js EXFIL - Network Request in index.js: "axios.post(" - System Information Collection in index.js: "os.userInfo()" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Shell Command Execution in index.js: "require("child_process")" - Platform Detection with Data Collection in index.js: "JSON.stringify({ created, username, publicIp: "unknown", platform: process.platf..." - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern - Malicious Dependency Detected in package.json PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 384bfd3285cd0d548b83db4b86ab54a6f0f41991dbea92f8c0fdb554f2d65992