GCVE-110-OSM-2026-8006

The package contains a clearly visible 'PHANTOM v3' dropper embedded after the legitimate Solana utility exports in index.js. After a 37-second delay (evasion), it reads a base64-encoded second-stage payload from `test/fixtures/keypairs.dat`, writes it to `~/.cache-db/.node-sync/syncd.js` with mode 0o700, installs cross-platform persistence (cron on Linux, schtasks on Windows, LaunchAgent plist `com.apple.syncd` on macOS running every 12 hours), and then spawns the payload as a detached background process with suppressed I/O so it survives parent exit. The decoded content of `keypairs.dat` contains IPFS gateway URLs (`ipfs.io`, `cloudflare-ipfs.com`) consistent with remote payload staging and keywords `child_process`, `token`, `secret` indicating the second stage performs credential theft or exfiltration. The publisher `solbuilder_io` has a prior confirmed malicious package (`eth-wallet-helpers`, OSM threat 50199fc3) on the same account, establishing a pattern of supply-chain attacks masquerading as crypto developer tooling. ENTRY index.js (main: index.js) PERSISTENCE - Cron Job Persistence in index.js: "crontab -" EXFIL - System Information Collection in index.js: "process.platform" OBFUSCATION - Decoded Base64 Content in test/fixtures/keypairs.dat - Dynamic Base64 Decoding in index.js: "Buffer.from(b64, "base64")" - Deobfuscation Failed in index.js - recovered 1 urls, 2 domains, 3 paths from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn("node", [s], { detached: true, stdio: "ignore" }" - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn("node", [s], { detached: true" - Brand New Package - Publisher Has Other Malicious Packages PAYLOAD FILES index.js (+ test/fixtures/keypairs.dat) INDICATORS (IOCs) - urls: https://${gw}/ipfs/${cid}` - domains: ipfs.io, cloudflare-ipfs.com - paths: ~/.cache-db/.node-sync/syncd.js, /usr/bin/node, /usr/local/bin/node</string><string>${scriptPath}</string></array> - payloadFileHash: 94a6f03e81da3052eb2d3af5c4fe9b903191cce85e56688c1ac58fa78bf5502a