GCVE-110-OSM-2026-6715

APT malware detected: chai-max. Associated with threat actor(s): DPRK/Lazarus. Behaviors: code execution, obfuscated code. ENTRY dist/cjs/index.js (main: ./dist/cjs/index.js) DESTINATION - bitcoinAddresses: 11111111111111111111111111111111 (exfil, plaintext) OBFUSCATION - Dynamic Base64 Decoding in dist/cjs/utils/bytes/base64.js: "Buffer.from(data, "base64")" - Dynamic Base64 Decoding in dist/esm/utils/bytes/base64.js: "Buffer.from(data, "base64")" - Strings Extracted from Deobfuscated Code in dist/cjs/utils/bytes/base64.js - Deobfuscation Failed in dist/esm/utils/bytes/base64.js ADDITIONAL FINDINGS - Chai-Max Wallet Theft Indicators in dist/tsconfig.cjs.tsbuildinfo: "solana/web3.js/lib/index.d.ts","../node_modules/@coral-xyz/anchor-errors/dist/in..." - Dynamic Code Execution in dist/browser/index.js: "exec(anchorErrorLog)" - Very New NPM Publisher Account PAYLOAD FILES dist/tsconfig.cjs.tsbuildinfo (+ dist/tsconfig.tsbuildinfo, dist/browser/index.js) INDICATORS (IOCs) - urls: https://coral-xyz.github.io/anchor/ts/index.html, https://caniuse.com/textencoder. - domains: coral-xyz.github.io, caniuse.com, index.es - sha256Hashes: 44e584d4f6444f58791784f1d530875970993129442a847597db702a073ca68c, 45b7ab580deca34ae9729e97c13cfd999df04416a79116c3bfb483804f85ded4, 3facaf05f0c5fc569c5649dd359892c98a85557e3e0c847964caeb67076f4d75, 9a68c0c07ae2fa71b44384a839b7b8d81662a236d4b9ac30916718f7510b1b2d, 5e1c4c362065a6b95ff952c0eab010f04dcd2c3494e813b493ecfd4fcb9fc0d8 (+45 more) - payloadFileHash: 7af9a2e547356f7e0f374b3aa104b922cd1f79d8f88608c8db0ff8028e239a1c