GCVE-110-OSM-2026-8696

This package is a credential-harvesting infostealer targeting developers. The postinstall hook executes scripts/postinstall.js on install, which systematically collects AWS credentials (~/.aws/credentials), SSH keys (~/.ssh/), .env files (including contents), .gitconfig, .npmrc, Foundry keystores, and environment variables matching crypto/cloud key patterns (KEY|SECRET|TOKEN|MNEMONIC|SEED|WALLET|AWS|INFURA|ALCHEMY). All harvested data is exfiltrated via a hardcoded Telegram bot (8797440605:AAEzk13-lD_Yif3TGP2fIGXhHgDBglTCpXk) to chat ID 7604069194, chunked to respect Telegram's message limits. The beacon tag 'BITU_NPM_BEACON' and version 99.0.0 suggest this is a deliberate supply-chain attack targeting web3/DeFi developers. The publisher account (hongfangfang) has zero prior packages and no repository link, consistent with a throwaway attack account. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - reconstructed: https://api.telegram.org/bot8797440605:AAEzk13-lD_Yif3TGP2fIGXhHgDBglTCpXk/sendMessage (primary, reconstructed) in scripts/postinstall.js - custom-c2: api.telegram.org (reconstructed) in scripts/postinstall.js - telegram-bot: 8797440605:AAEzk13-lD_Yif3TGP2fIGXhHgDBglTCpXk (plaintext) in scripts/postinstall.js - telegram-bot: api.telegram.org/bot${botToken}/sendMessage`, (plaintext) in scripts/postinstall.js EXFIL - Git Configuration Access in scripts/postinstall.js: ".gitconfig" - Network Request in scripts/postinstall.js: "https.request(" - System Information Collection in scripts/postinstall.js: "os.userInfo()" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in scripts/postinstall.js: "https://api.telegram.org/bot8797440605:AAEzk13-lD_Yif3TGP2fIGXhHgDBglTCpXk/sendM..." - Shell Command Execution in scripts/postinstall.js: "require('child_process')" PAYLOAD FILES scripts/postinstall.js INDICATORS (IOCs) - urls: https://t.me/LeoMessinio_bot - payloadFileHash: 82085c85e96c8faff6ee8080df8ee16c6534b782afd264830e86c6865b8d2b73 TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @LeoMessinio_bot (id 8797440605)