GCVE-110-OSM-2026-8519

This package pretends to be a CTF challenge but really, is hiding a multi-stage supply chain attack pattern. The package contains an XOR-encrypted credential stealer in src/install.js that harvests SSH keys, cloud credentials (AWS/GCP/Azure), environment variables containing secrets, browser-stored credentials (Chrome/Brave/Edge/Firefox), Slack tokens, .env files, git credentials, GPG keys, Kubernetes configs, and Docker credentials. Stolen data is tar.gz compressed and exfiltrated via Telegram Bot API. Includes anti-debugging (exits on --inspect/--debug), anti-analysis timing checks, and sandbox evasion (OG_ env var check). The outer script uses junk code camouflage (fake game functions), string-array rotation obfuscation, and XOR encryption with a key derived from /etc/passwd to hide the real payload which is eval d at runtime. ENTRY src/install.js (install-hook: make -C src && cp src/auth_module ./bin/flare && node src/install.js) - Install Hook Executes Local JS File in package.json OBFUSCATION - Unicode Escape Obfuscation in src/install.js: "\u15E1\u6C29\u416C\u0680\u4B30\u5823\u7053" - Obfuscation (osm-deobfuscator): unknown in src/install.js - Obfuscation patterns: debuggerTraps, unicodeHeavy, hexHeavy in src/install.js ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" PAYLOAD FILES index.js (+ src/install.js) INDICATORS (IOCs) - domains: libc.so - payloadFileHash: 0ade412362d2cfffe7a543f7eddb7ea9aad45b30364cac22ed998d7a5d2033b5