GCVE-110-OSM-2026-7966

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY dist/chain-sdk-js.cjs.js (main: dist/chain-sdk-js.cjs.js) LOOT - Cryptocurrency Wallet Theft in dist/chain-sdk-js.umd.js: "mnemonic phrase" - Cryptocurrency Wallet Theft in dist/thetajs.umd.js: "mnemonic phrase" DESTINATION - reconstructed: https://ethers.xdai.quiknode.pro/v1/lb/${...} (primary, reconstructed) - custom-c2: ethers.xdai.quiknode.pro (reconstructed) in dist/chain-sdk-js.umd.js - custom-c2: http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring (plaintext) in dist/chain-sdk-js.umd.js - custom-c2: https://git.io/vad3K (plaintext) in dist/chain-sdk-js.umd.js - custom-c2: https://npms.io/search?q=ponyfill. (plaintext) in dist/chain-sdk-js.umd.js - custom-c2: https://mathiasbynens.be/notes/javascript-unicode (plaintext) in dist/chain-sdk-js.umd.js - custom-c2: http://eev.ee/blog/2015/09/12/dark-corners-of-unicode/ (plaintext) in dist/chain-sdk-js.umd.js - custom-c2: https://bugs.webkit.org/show_bug.cgi?id=156034 (plaintext) in dist/chain-sdk-js.umd.js (+93 more) EXFIL - Data Encoding for Exfiltration in dist/chain-sdk-js.umd.js: "btoa(" - Data Encoding for Exfiltration in dist/thetajs.umd.js: "btoa(" OBFUSCATION - Dynamic Base64 Decoding in dist/chain-sdk-js.umd.js: "atob(textData)" - Obfuscation: function to array replacements in dist/chain-sdk-js.umd.js - Dynamic Base64 Decoding in dist/thetajs.umd.js: "atob(textData)" - Obfuscation: function to array replacements in dist/thetajs.umd.js - Base64 Encoded Payload in dist/chain-sdk-js.umd.js: "'AEQF2AO2DEsA2wIrAGsBRABxAN8AZwCcAEwAqgA0AGwAUgByADcATAAVAFYAIQAyACEAKAAYAFgAGwA..." - Base64 Encoded Payload in dist/thetajs.umd.js: "'AEQF2AO2DEsA2wIrAGsBRABxAN8AZwCcAEwAqgA0AGwAUgByADcATAAVAFYAIQAyACEAKAAYAFgAGwA..." - Obfuscation patterns: charCodeArrayBuild, charCodeChain in dist/thetajs.browser.js - Obfuscation patterns: charCodeChain, unicodeHeavy, hexHeavy in dist/chain-sdk-js.umd.js (+2 more) ADDITIONAL FINDINGS - Dynamic Code Execution in dist/chain-sdk-js.cjs.js: "exec(errorMessage)" - Shell Command Execution in dist/chain-sdk-js.cjs.js: "require('child_process')" - Detached Child Process Payload in dist/chain-sdk-js.cjs.js: "spawn('node', [], { detached: true" - XOR-Encoded String Arrays in dist/chain-sdk-js.umd.js: "var groupSizes = [ 0, 0, 25, 16, 12, 11, 10, 9, 8, 8, 7, 7, 7, 7, 6, 6, 6, 6, 6,..." - Suspicious URL Pattern in Template Literal in dist/chain-sdk-js.umd.js: "https://ethers.xdai.quiknode.pro/v1/lb/${...}" - Brand New Package (+1 more) PAYLOAD FILES dist/chain-sdk-js.umd.js (+ dist/thetajs.umd.js) INDICATORS (IOCs) - ipv4: 13.3.3.7 - ipv6: 1086:175::, 4920:8128:: - urls: https://thetatoken.org, https://theta-bridge-rpc.thetatoken.org/rpc, https://eth-rpc-api.thetatoken.org, https://explorer.thetatoken.org, https://explorer-api.thetatoken.org (+15 more) - domains: thetatoken.org, theta-bridge-rpc.thetatoken.org, eth-rpc-api.thetatoken.org, explorer.thetatoken.org, explorer-api.thetatoken.org (+6 more) - emails: start@yc.length, adding@yc.length, fedor@indutny.com - sha256Hashes: e60fce93b59e9ec53011aabc21c23e97b2a31369b87a5ae9c44ee89e2a6dec0a, f7e3507399e595929db99f34f57937101296891e44d23f0be1f32cce69616821, 8282263212c609d9ea2a6e3e172de238d8c39cabd5ac1ca10646e23fd5f51508, 11f8a8098557dfe45e8256e830b60ace62d613ac2f7b17bed31b6eaff6e26caf, 175e159f728b865a72f99cc6c6fc846de0b93833fd2222ed73fce5b551e5b739 (+45 more) - payloadFileHash: 798a5be3715570c3cfdb308a06bcc5fe60094b151368a0c2e0db98d502c36223