GCVE-110-OSM-2026-6576

UPDATE: September 1, 2026: This package is pushing malware again! Versions 4.2.17 and 4.2.18 both have a malicious payload in public/fonts/fa-solid-400.woff2. .vscode/tasks.json executes this payload when the source is opened with VSCode. UPDATE: August 24, 2026 -- This package has had a secondary infection pushing new DPRK PolinRider payloads into this package in July and August. NPM/GitHub automated scanning didn't catch this. Payloads are found in: - .vscode/tasks.json - babel.config.cjs - public/fonts/fa-solid-400.woff2 Hijacked legitimate npm package commits a .vscode/tasks.json with runOptions.runOn: 'folderOpen', auto-executing on folder open in VS Code / Cursor / Antigravity and bypassing npm v12 lifecycle-script hardening. A fake font file (public/fonts/fa-solid-400.woff2) is a JavaScript loader that fetches XOR-encrypted next-stage payloads from blockchain 'dead drop' transactions on Tron and Aptos, then runs a socket.io backdoor and a Python infostealer harvesting browser credentials, crypto wallets, password managers, developer tools and OS keystores across Windows/macOS/Linux. Exfiltration via HTTP C2 and Telegram. This is confirmed DPRK/PolinRider tradecraft. === STAGE 1: VS Code autorun === File: .vscode/tasks.json with runOptions.runOn: 'folderOpen' executes automatically when the project folder is opened (VS Code, Cursor, Antigravity, GitHub Desktop). Evades npm v12 lifecycle-script protections. === STAGE 2: Fake font loader / blockchain dead drop === File: public/fonts/fa-solid-400.woff2 is disguised JavaScript. It reads XOR-encrypted payloads from on-chain transactions on Tron (api.trongrid.io) and Aptos (fullnode.mainnet.aptoslabs.com); also abuses bsc-dataseed.binance.org / bsc-rpc.publicnode.com. XOR keys: 2[gWfGj;<:-93Z^C and ThZG+0jfXE6VAGOJ. Victim marker example: _V = "A8-**". Tron dead-drop accounts: TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP, TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG, TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v Aptos dead-drop accounts: 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e, 0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3, 0x533b2dbcaeff19cd1f799234a27b578d713d8fcaa341b7501e4526106483e0b1 === STAGE 3: socket.io backdoor === Interactive command execution, file upload/download, clipboard access. C2 IPs 166.88.134.62, 198.105.127.210, 23.27.202.27 (ports 443, 27017). Paths: /$/boot, /$/{id}, /verify-human/{channel}, /snv, /u/e, /u/f, /d/python.zip, /d/python.7z, /d/7zr.exe. Victim marker sent in HTTP headers. === STAGE 4: Python runtime bootstrap === Installs Node deps and a portable Python (bootstrap.pypa.io/get-pip.py) under %LOCALAPPDATA%\Programs\Python\Python3127, ~/.node_modules, /tmp/.npm, %USERPROFILE%\.npm. === STAGE 5: Python infostealer === Reversed-base64 + zlib wrapped. Harvests credentials from browsers, crypto wallets, password managers, developer tools and OS keystores. Exfiltrates files via api.telegram.org/bot{token}/sendDocument (token prefix 7870147428:AAGbYG..., upload target ID 7699029999) and the HTTP C2.