GCVE-110-OSM-2026-6523

This package is a typosquat of the popular 'chalk' npm package, published by a brand-new account ('venusqq_1234') that impersonates Andris Reinman (the legitimate nodemailer author) and bundles nodemailer source as a decoy. The attacker model is a classic install-hook-paste-loader chain: the postinstall script executes `lib/utils/index.js`, which immediately spawns a fully detached child process running `lib/utils/smtp-connection/index.js` with all stdio suppressed (`detached: true, stdio: ['ignore','ignore','ignore']`), then calls `child.unref()` to survive parent exit. That child process fetches a second-stage payload from `https://jsonkeeper.com/b/OMNQZ`, a paste-as-JSON staging service. The legitimate nodemailer code wrapped around the malicious utilities is pure camouflage; the two injected files under `lib/utils/` are the actual attack surface, and the applied combos 'install-hook-paste-loader' and 'download-and-execute-payload' are unambiguous. ENTRY lib/utils/index.js (install-hook: node lib/utils/index.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://proxy.host:3128/ (primary, plaintext) in lib/smtp-connection/http-proxy-client.js - custom-c2: https://jsonkeeper.com/b/OMNQZ (plaintext) in lib/utils/smtp-connection/index.js EXFIL - Data Encoding for Exfiltration in lib/fetch/index.js: "Buffer.from(parsed.auth).toString('base64')" - Data Encoding for Exfiltration in lib/mime-funcs/index.js: "EncodeURIComponent(chr" - Data Encoding for Exfiltration in lib/smtp-connection/http-proxy-client.js: "Buffer.from(proxy.auth).toString('base64')" - Data Encoding for Exfiltration in lib/smtp-connection/index.js: "Buffer.from( //this._auth.user+'\u0000'+ '\u0000' + // skip authorization identi..." - Payload Download from Paste Service in lib/utils/smtp-connection/index.js: "jsonkeeper.com" - DNS Lookup in lib/mailer/index.js: "dns.resolve(" - DNS Lookup in lib/shared/index.js: "dns.lookup(" - System Information Collection in lib/smtp-connection/index.js: "os.hostname()" OBFUSCATION - Dynamic Base64 Decoding in lib/shared/index.js: "Buffer.from(data, 'base64')" - Dynamic Base64 Decoding in lib/smtp-connection/index.js: "Buffer.from(challengeString, 'base64')" - Strings Extracted from Deobfuscated Code in lib/shared/index.js - Strings Extracted from Deobfuscated Code in lib/smtp-connection/index.js ADDITIONAL FINDINGS - Suspicious TLD Domain in lib/nodemailer.js: "https://ethereal.email" - Shell Command Execution in lib/sendmail-transport/index.js: "child_process').spawn" - Detached Child Process Payload in lib/utils/index.js: "spawn(process.execPath, [filePath], { detached: true" - Malicious Dependency Detected in package.json PAYLOAD FILES lib/smtp-connection/index.js (+ lib/shared/index.js) INDICATORS (IOCs) - urls: https://Ethereal.email, https://nodemailer.com/smtp/oauth2/, https://nodemailer.com/message/calendar-events/, https://nodemailer.com/, http://nodemailer.com/2-0-0-beta/templating/ (+10 more) - domains: nodemailer.com, Nodemailer.com, litmus.com, data.group, address.group (+34 more) - emails: andris@kreata.ee, info@nodemailer.com, test@googlemail.com - sha256Hashes: 1c7631aca0c00365e8a7e68dd11045e1d4475c909885d8dccd881f4dce9d0566 - payloadFileHash: 958e7143edb3522c0b1ed6bc3f71154d0c29ddc9ba2802d52ffec9c1ae0d88da