GCVE-110-OSM-2026-8017

This package implements a classic malware dropper pattern clearly visible in index.js. After a 37-second delay (evasion), it reads a base64-encoded payload from 'test/fixtures/keypairs.dat', decodes it, writes it to '~/.cache-db/.node-sync/syncd.js' with executable permissions, then establishes persistence via crontab (Linux, every 12 hours) or Windows Task Scheduler ('WinNodeSync'), and finally spawns the payload as a detached background process with stdio suppressed so it survives the parent process. The publisher 'solbuilder_io' already has a confirmed critical-severity malicious package (eth-wallet-helpers) in OSM, and this account published 4 versions in under 6 hours across a cluster of 10 crypto/blockchain-themed packages — a clear multi-package supply chain attack campaign. The attacker model is a crypto-focused stealer or RAT distributed via npm typosquatting/dependency confusion targeting Ethereum/Solana developers. ENTRY index.js (main: index.js) PERSISTENCE - Cron Job Persistence in index.js: "crontab -" EXFIL - System Information Collection in index.js: "process.platform" ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn("node", [s], { detached: true, stdio: "ignore" }" - Download Execute Delete Pattern in index.js: "writeFileSync(s, Buffer.from(f.readFileSync(src, "utf8").trim(), "base64").toStr..." - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn("node", [s], { detached: true" - Brand New Package (+2 more) PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 464fe455f640ff325eb2f924512ee5d921948e3fe54687ebcce8f38af697f799