GCVE-110-OSM-2026-8012

The entrypoint (index.js) contains a clearly readable 'PHANTOM DROPPER' section that wraps a legitimate-looking crypto validator as cover. After a 37-second delay, it reads a base64-encoded payload from `test/fixtures/keypairs.dat`, decodes it to `~/.cache-db/.node-sync/syncd.js`, sets it executable (mode 0o700), installs a cron job or Windows scheduled task for persistence running every 12 hours, then spawns it as a detached background process with stdio suppressed to survive parent exit. The decoded content in keypairs.dat contains URLs referencing IPFS gateways (ipfs.io, cloudflare-ipfs.com), sensitive paths, child_process, token, and secret keywords — consistent with a remotely-fetched second-stage payload served via IPFS to evade static URL blocking. The publisher 'solbuilder_io' already has a confirmed critical-severity malicious package (eth-wallet-helpers) in OSM, and this package was published within seconds of account creation with zero downloads — a classic throwaway account pattern for campaign infrastructure. ENTRY index.js (main: index.js) PERSISTENCE - Cron Job Persistence in index.js: "crontab -" DESTINATION - ethereumAddresses: 0x5aAeb6053F3E94C9b9A09f33669435E7Ef1BeAed (exfil, plaintext) EXFIL - System Information Collection in index.js: "process.platform" OBFUSCATION - Decoded Base64 Content in test/fixtures/keypairs.dat - Dynamic Base64 Decoding in index.js: "Buffer.from(b64, "base64")" - Deobfuscation Failed in index.js - recovered 1 urls, 2 domains, 3 paths from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn("node", [s], { detached: true, stdio: "ignore" }" - Download Execute Delete Pattern in index.js: "writeFileSync(s, Buffer.from(b64, "base64").toString("utf8"), { mode: 0o700 }); ..." - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn("node", [s], { detached: true" - Brand New Package (+1 more) PAYLOAD FILES index.js (+ test/fixtures/keypairs.dat) INDICATORS (IOCs) - urls: https://${gw}/ipfs/${cid}` - domains: ipfs.io, cloudflare-ipfs.com - paths: ~/.cache-db/.node-sync/syncd.js, /usr/bin/node, /usr/local/bin/node</string><string>${scriptPath}</string></array> - payloadFileHash: 9571dff0efc7bc24e335a031e90250e1816f70de5f7e3d10ca02057afad6f7d8