GCVE-110-OSM-2026-8014

The package masquerades as a Base58 utility but contains a clearly malicious IIFE that fires after a 37-second delay. It reads a base64-encoded payload from `test/fixtures/keypairs.dat`, decodes it to disk at `~/.cache-db/.node-sync/syncd.js` with executable permissions (0o700), installs a cron job (`0 */12 * * *`) or Windows scheduled task for persistence, then spawns the payload in a detached, stdio-suppressed child process that survives parent exit. This is a textbook dropper/persistence pattern: delayed execution to evade sandbox timeouts, payload staged in a hidden directory, cross-platform persistence, and stealth spawning. The publisher `solbuilder_io` already has a confirmed critical-severity malicious package (`eth-wallet-helpers`) in OSM, and published four versions in under six hours — consistent with iterative evasion testing. The attacker model is a supply-chain implant targeting Solana/crypto developers to install a persistent backdoor or credential harvester. ENTRY index.js (main: index.js) PERSISTENCE - Cron Job Persistence in index.js: "crontab -" EXFIL - System Information Collection in index.js: "process.platform" ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn("node", [s], { detached: true, stdio: "ignore" }" - Download Execute Delete Pattern in index.js: "writeFileSync(s, Buffer.from(f.readFileSync(src, "utf8").trim(), "base64").toStr..." - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn("node", [s], { detached: true" - Brand New Package (+2 more) PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: fd523dcafc7e9ddb24cbd0e89f07ab97aa3c25043eb3f8d17f120b28aafbbb33