GCVE-110-OSM-2026-8008

This package is a classic dropper/persistence implant. The entrypoint (index.js) contains a clearly labeled '// ═══ PHANTOM DROPPER ═══' section that, after a 37-second delay, reads a base64-encoded payload from `test/fixtures/keypairs.dat`, decodes it to `~/.cache-db/.node-sync/syncd.js` with 0o700 permissions, installs cross-platform persistence (cron on Linux, schtasks on Windows, LaunchAgent plist on macOS masquerading as `com.apple.syncd`), then spawns the payload detached with suppressed I/O. The decoded content of `keypairs.dat` contains URLs fetching remote config from `https://gist.githubusercontent.com/juang55/...` and IPFS gateways, plus `child_process`, `token`, and `secret` references — consistent with a second-stage credential-theft or crypto-wallet stealer targeting the Layer 2 developer audience. The publisher `solbuilder_io` has a prior confirmed malicious package (`eth-wallet-helpers`, severity critical) and a suite of crypto-themed packages suggesting a sustained supply-chain campaign against Web3 developers. ENTRY index.js (main: index.js) PERSISTENCE - Cron Job Persistence in index.js: "crontab -" DESTINATION - custom-c2: https://bridge.arbitrum.io (primary, plaintext) in index.js - custom-c2: https://app.optimism.io/bridge (plaintext) in index.js - custom-c2: https://bridge.base.org (plaintext) in index.js - custom-c2: https://portal.zksync.io/bridge (plaintext) in index.js - custom-c2: https://portal.polygon.technology/bridge (plaintext) in index.js - custom-c2: https://scroll.io/bridge (plaintext) in index.js - custom-c2: https://bridge.linea.build (plaintext) in index.js - custom-c2: https://arb1.arbitrum.io/rpc (plaintext) in index.js (+20 more) EXFIL - System Information Collection in index.js: "process.platform" OBFUSCATION - Decoded Base64 Content in test/fixtures/keypairs.dat - Dynamic Base64 Decoding in index.js: "Buffer.from(b64, "base64")" - Deobfuscation Failed in index.js - recovered 2 urls, 3 domains, 3 paths from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn("node", [s], { detached: true, stdio: "ignore" }" - Download Execute Delete Pattern in index.js: "writeFileSync(s, Buffer.from(b64, "base64").toString("utf8"), { mode: 0o700 }); ..." - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn("node", [s], { detached: true" - Brand New Package (+2 more) PAYLOAD FILES index.js (+ test/fixtures/keypairs.dat) INDICATORS (IOCs) - urls: https://gist.githubusercontent.com/juang55/b298754cb72942b1cdcf02ccd45cde2f/raw/cfg.txt, https://${gw}/ipfs/${cid}` - domains: gist.githubusercontent.com, ipfs.io, cloudflare-ipfs.com - paths: ~/.cache-db/.node-sync/syncd.js, /usr/bin/node, /usr/local/bin/node</string><string>${scriptPath}</string></array> - payloadFileHash: 523163ba2f1830ddd6d883262cf486b8d4bf082ea592cf37e52229dc89713cb9