GCVE-110-OSM-2026-8537

Typosquat of the NordPass password manager. The package contains an XOR-encrypted credential stealer in src/install.js that harvests SSH keys, cloud credentials (AWS/GCP/Azure), environment variables containing secrets, browser-stored credentials (Chrome/Brave/Edge/Firefox), Slack tokens, .env files, git credentials, GPG keys, Kubernetes configs, and Docker credentials. Stolen data is tar.gz compressed and exfiltrated via Telegram Bot API. Includes anti-debugging (exits on --inspect/--debug), anti-analysis timing checks, and sandbox evasion (OG_ env var check). The outer script uses junk code camouflage (fake game functions), string-array rotation obfuscation, and XOR encryption with a key derived from /etc/passwd to hide the real payload which is eval d at runtime. Multi-stage credential stealer: (1) Outer layer uses XOR decryption (key: xQ4!mZ9@vL2#pR7$wB3&kT8 + /etc/passwd first line) to decrypt embedded base64 blob, then eval()s the result. (2) Inner payload harvests: SSH private/public keys and configs from ~/.ssh and /home/*/.ssh; AWS/GCP/Azure credential files; environment variables matching token/key/secret/password/credential patterns; Slack tokens from CLI, desktop app, and LevelDB storage; browser credentials from Chrome/Chromium/Brave/Edge (Login Data sqlite, Local Storage LevelDB) and Firefox (cookies, form history, session stores); .npmrc/.yarnrc tokens; kubeconfig; Docker configs; Terraform credentials; git-credentials; GPG secret keys; .env files recursively. (3) Creates device_id.txt with username/hostname/uid/cwd. (4) Archives all harvested files into user_hostname.tar.gz. Also contains dormant functions for AWS/GCP/Azure IMDS metadata harvesting and GitHub Actions runner /proc/mem scraping (defined but not called).