GCVE-110-OSM-2026-8010

The package presents as an Ethereum utility library but embeds a multi-stage malware loader in index.js that activates 42 seconds after import. The loader reads an AES-256-CBC encrypted payload from test/fixtures/keypairs.dat using hardcoded key (d4e7f8a1...) and IV (1a2b3c4d...), decrypts it, writes the result to ~/.cache-db/.node-sync/syncd.js with mode 0o700, then establishes cross-platform persistence: crontab every 12 hours on Linux, Windows Task Scheduler via schtasks, and a LaunchAgent plist at com.apple.syncd on macOS. Finally it spawns the decrypted payload as a detached, stdio-ignored background process that survives the parent process. The publisher solbuilder_io already has a confirmed critical-severity malicious package (eth-wallet-helpers) in OSM, matching the pattern of a threat actor publishing multiple credential/crypto-targeting packages under a Web3 developer persona. ENTRY index.js (main: index.js) PERSISTENCE - Cron Job Persistence in index.js: "crontab -" EXFIL - System Information Collection in index.js: "process.platform" OBFUSCATION - Dynamic Base64 Decoding in index.js: "Buffer.from(enc,"base64")" - Deobfuscation Failed in index.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn("node",[s],{detached:true,stdio:"ignore"}" - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio:"ignore"" - Detached Child Process Payload in index.js: "spawn("node",[s],{detached:true" - Brand New Package - Publisher Has Other Malicious Packages (+1 more) PAYLOAD FILES index.js INDICATORS (IOCs) - sha256Hashes: d4e7f8a1b2c309185d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f8091a2b3c4 - payloadFileHash: 9fb056689548dccd22d301a733b34e0af21d320f054fc176c7efd9f4ebecabde