GCVE-110-OSM-2026-8859

This package implements a multi-stage supply chain attack executed on install via postinstall hook. The `from_str_2()` function fetches an SSH public key from `http://170.205.31.203:3001/api/ssh-key` and writes it to the victim's `~/.ssh/authorized_keys`, establishing persistent backdoor access. Simultaneously, `from_str_1()` recursively scans the working directory for config files (`.env`, `config.toml`, `id.json`) and exfiltrates them with the current user's identity prepended to `http://170.205.31.203:3000/api/v1`. The `from_str_2()` function also fetches dynamic scan/block patterns from the C2, performs a full filesystem crawl (cross-platform, including Windows drive enumeration via `wmic`), and batch-uploads discovered files to `http://170.205.31.203:3001/api/v1`. The publisher account (`hkdeimlqdgkqdicqlv@onldm.net`) is a throwaway with zero prior packages, and the package description is generic cover text. This is a credential/secrets harvester with SSH persistence implant. ENTRY test.js (install-hook: node test.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://170.205.31.203:3000/api/v1 (primary, plaintext) in index.js - custom-c2: http://170.205.31.203:3001/api/ssh-key (plaintext) in index.js - custom-c2: http://170.205.31.203:3001/api/scan-patterns (plaintext) in index.js - custom-c2: http://170.205.31.203:3001/api/block-patterns (plaintext) in index.js - custom-c2: http://170.205.31.203:3001/api/v1 (plaintext) in index.js - custom-c2: 170.205.31.203 (plaintext) in index.js EXFIL - Environment Variable Exfiltration in index.js: "process.env.USER || "unknown"; const payload = Buffer.concat([Buffer.from(`${env..." - Network Request in index.js: "fetch("http:" - System Information Collection in index.js: "os.userInfo()" - Suspicious Domain in index.js: "http://170.205.31.203" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "windowsHide: true" - Platform Detection with Data Collection in index.js: "JSON.stringify({ created, username, publicIp, platform: process.platform" - Malicious Dependency Detected in package.json PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: d986a2e0a9eb3fc3781e166ff6b700e0d38249a6c9649982243c3754671f42d9