GCVE-110-OSM-2026-8698

This package masquerades as a pino logger utility but contains a fully implemented credential/file theft payload in dist/logger.js. The attacker model is clear: on import, the package collects OS info, IP address, username, and environment variables, then recursively traverses the filesystem collecting .env, .json, and document files, reading their contents and encoding them as base64 — all POSTed to the attacker-controlled C2 at https://api.mywalletsss.store/api/validate/system-info. On Linux specifically, it also injects a hardcoded SSH public key (`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJxc6YPFfHFzBsAu7z2wZEmwuHc9zBuOoUYrIRM6W+Ai dev-key`) into ~/.ssh/authorized_keys, establishing persistent backdoor SSH access. The publisher account `prettyio-77` has zero prior packages and no repository, and the variable obfuscation (single-letter renamed identifiers) is consistent with deliberate code concealment. This is a classic supply-chain credential harvester with SSH persistence, consistent with the Contagious Interview / invisible-ferret attacker family. ENTRY dist/index.js (main: dist/index.js) DESTINATION - reconstructed: https://api.mywalletsss.store/api/validate/system-info (primary, reconstructed) in dist/logger.js - custom-c2: api.mywalletsss.store (reconstructed) in dist/logger.js - custom-c2: https://api.mywalletsss.store (plaintext) in dist/logger.js EXFIL - HTTP Data Exfiltration in dist/logger.js: "process.cwd(); const projectConfigFiles = yield p84(projectRoot); const u82 = yi..." OBFUSCATION - String Array Obfuscation in dist/logger.js: "[ 'node_modules', 'Library', 'System', 'Windows', 'Program Files', 'Program File..." - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in dist/logger.js: "https://api.mywalletsss.store/api/validate/system-info" PAYLOAD FILES dist/logger.js INDICATORS (IOCs) - payloadFileHash: 8c18f73e61b1e842755efccf79fbb04f475bd6b49422735eb991b4245e07875e