GCVE-110-OSM-2026-8875

Fake job-interview lure delivering malware via public GitHub repositories. Victims are approached (LinkedIn/freelance platforms) with a fabricated technical assessment requiring them to clone and execute code from a repository. The repo contains a C2 to a Vercel-hosted staging endpoint (base64-encoded C2 config: httpx://ip-testcheck.vercel.app/api) and exfiltrates local environment variables and other developer secrets before executing server-supplied code. Repos: httpx://github.com/tarsaihub/AgentMesh/ httpx://github.com/Afivelabs/AmonixPlay/ httpx://github.com/ronihuman333-byte/aiagent/ httpx://github.com/ronihuman333-byte/a5/ httpx://github.com/ronihuman333-byte/a5cr/ C2s: New: httpx://ip-testcheck.vercel.app/api (I have reported this to Vercel) Old: httpx://test-g-acs.vercel.app/api/data httpx://ake-test.vercel.app/api/data httpx://project-mjecx.vercel.app/api Accounts: leograntbz-byte : leogrant.bz@gmail.com tt1089131-cpu : tt1089131@gmail.com lxin6793-dot : lxin6793@gmail.com aaronhirotobm-lgtm : aaronhiroto.bm@gmail.com Matías : mjlescano@protonmail.com Cherik : Pourcheriki@gmail.com Mann-004 : randhawamanpreet37@gmail.com coin : coinstar@gmail.com sparkdev0917 : webvlada2024@gmail.com VladimirSimic2024 : webvlada2024@gmail.com Jobelo Andres Quintero Rodriguez : ignusmart@gmail.com ronihuman333-byte : ronihuman333@gmail.com Two-stage payload embedded in controllers/auth.js, auto-triggered on module load via a VS Code task and redundantly via the npm prepare lifecycle hook. In the stage 1 it exfiltrates the full process.env (via axios.post) to a base64-encoded Vercel-hosted C2 endpoint (AUTH_API in .env, header x-app-request: ip-check). The C2 response body is passed directly into new Function("require", response.data), executing arbitrary attacker-supplied JS with full require() access.This two-stage architecture is consistent with the BeaverTail malware family associated with the Contagious Interview/Fake Recruiters campaign httpx://github.com/tarsaihub/AgentMesh/blob/main/.vscode/tasks.json httpx://github.com/tarsaihub/AgentMesh/blob/main/controllers/auth.js httpx://github.com/tarsaihub/AgentMesh/blob/main/routes/api/auth.js