GCVE-110-OSM-2026-8015

The package contains a clearly labeled '// ═══ PHANTOM DROPPER ═══' section in index.js that, after a 37-second delay, reads a base64-encoded payload from test/fixtures/keypairs.dat, decodes and writes it as an executable to ~/.cache-db/.node-sync/syncd.js, then establishes cross-platform persistence via cron (Linux), schtasks (Windows), and a LaunchAgent plist masquerading as 'com.apple.syncd' (macOS), before spawning the dropped payload as a detached background process. The attacker model is a supply-chain dropper targeting crypto/blockchain developers: the package is disguised as a legitimate Arbitrum L2 toolkit, and the payload is fetched/staged from a GitHub Gist (https://gist.githubusercontent.com/juang55/b298754cb72942b1cdcf02ccd45cde2f/raw/cfg.txt) with IPFS as a fallback delivery mechanism. The publisher 'solbuilder_io' already has a confirmed critical-severity malicious package (eth-wallet-helpers) in OSM, establishing a pattern of targeting the crypto developer ecosystem. The keypairs.dat file contains decoded URLs referencing child_process, token, and secret keywords, strongly indicating the second-stage payload performs credential theft. ENTRY index.js (main: index.js) PERSISTENCE - Cron Job Persistence in index.js: "crontab -" DESTINATION - custom-c2: https://arb1.arbitrum.io/rpc (primary, plaintext) in index.js - custom-c2: https://nova.arbitrum.io/rpc (plaintext) in index.js - custom-c2: https://sepolia.arbitrum.io/rpc (plaintext) in index.js - custom-c2: arb1.arbitrum.io (plaintext) in index.js - custom-c2: arbiscan.io (plaintext) in index.js - custom-c2: nova.arbitrum.io (plaintext) in index.js - custom-c2: nova.arbiscan.io (plaintext) in index.js - custom-c2: sepolia.arbiscan.io (plaintext) in index.js EXFIL - System Information Collection in index.js: "process.platform" OBFUSCATION - Decoded Base64 Content in test/fixtures/keypairs.dat - Dynamic Base64 Decoding in index.js: "Buffer.from(b64, "base64")" - Deobfuscation Failed in index.js - recovered 2 urls, 3 domains, 3 paths from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn("node", [s], { detached: true, stdio: "ignore" }" - Download Execute Delete Pattern in index.js: "writeFileSync(s, Buffer.from(b64, "base64").toString("utf8"), { mode: 0o700 }); ..." - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn("node", [s], { detached: true" - Brand New Package (+2 more) PAYLOAD FILES index.js (+ test/fixtures/keypairs.dat) INDICATORS (IOCs) - urls: https://gist.githubusercontent.com/juang55/b298754cb72942b1cdcf02ccd45cde2f/raw/cfg.txt, https://${gw}/ipfs/${cid}` - domains: gist.githubusercontent.com, ipfs.io, cloudflare-ipfs.com - paths: ~/.cache-db/.node-sync/syncd.js, /usr/bin/node, /usr/local/bin/node</string><string>${scriptPath}</string></array> - payloadFileHash: e49d10ae4543c25c36705eee15b21cf16c9271a1cd515e7379951d7d2cea9acb