GCVE-110-OSM-2026-8513

This Rust package pretends to be a legitimate Mysten Labs package. It has a malicious build script (build.rs) that executes automatically on cargo build / cargo install. The presence of println!("cargo:warning=...") at the end is diagnostic: this is a Cargo build-script directive and fires without explicit invocation by the victim. Payload: build.rs The payload impersonates Mysten Labs (the company behind the Sui blockchain), suggesting the carrier crate is either typosquatting a sui-* / mysten-* package on crates.io, or has been planted in a repo Sui/Move developers would clone. Key findings: - Host reconnaissance. Shells out to collect hostname, whoami, and the current working directory (std::env::current_dir). - Campaign tagging. Formats the recon into a pipe-delimited string prefixed with src=sui-exec-cut-stealth — the word "stealth" in the source identifier is itself a giveaway. -Base64 encoding. Invokes powershell.exe with [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes(...)). Because the unwrap on this PowerShell call is not guarded, the full exfil path is Windows-only — it will panic on Linux/macOS before the beacon fires. -Double-channel exfiltration. A single HTTPS GET to a Supabase Edge Function carries the encoded blob twice: Query parameter: ?v=<base64> User-Agent header: MystenLabs-Audit-Cut-<base64> The duplication is likely defensive — if one channel is stripped by a proxy or WAF, the other still lands. -Masquerade. Emits a fake Cargo warning (MystenLabs Security Research: Validating Sui Execution Pipeline...) so any developer who notices the output during the build reads it as legitimate security tooling rather than a beacon. IOCs: - url: https://baoreqygjveumkkxydcd.supabase.co/functions/v1/Webhook_OOB - payloadFileHash: d98d398ca67efc52df7ca6e29f019cb8eef27a9d15c3724b539e80468b6fef36