GCVE-110-OSM-2026-7268

Malicious Go module 'github.com/verana-labs/verana-blockchain' compromised in the Miasma / Mini Shai-Hulud supply-chain worm campaign (Socket). The affected version(s) were published with a worm payload that steals developer credentials and self-propagates to other packages and repositories belonging to the compromised maintainer. Part of the Miasma / 'Mini Shai-Hulud' self-propagating supply-chain worm (Socket threat research). Behavior: a malicious install hook (npm postinstall / equivalent) executes a large obfuscated bundle (setup.js ~4.6MB) that harvests developer secrets — npm and GitHub tokens, cloud credentials, and environment variables — via secret-scanning, then exfiltrates them to attacker-controlled infrastructure. Worm propagation: using stolen npm/GitHub credentials, the payload republishes itself into the maintainer's other packages and injects itself into their repositories (package.json install hooks, .claude/settings.json, and similar), spreading across the victim's portfolio without operator interaction. Verdict from repository forensics: high_confidence_malicious.