GCVE-110-OSM-2026-9049

APT malware detected: chai-max. Associated with threat actor(s): DPRK/Lazarus. Behaviors: data exfiltration, install-time execution. ENTRY src/canary.js (install-hook: node src/canary.js) - Install Hook Executes Local JS File in package.json DESTINATION - reconstructed: https://96e03fa6c292469a-172-245-86-254.serveousercontent.com (primary, reconstructed) in src/canary.js - custom-c2: 96e03fa6c292469a-172-245-86-254.serveousercontent.com (reconstructed) in src/canary.js EXFIL - Network Request in src/canary.js: "https.get(" - DNS Lookup in src/canary.js: "dns.lookup(" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in src/canary.js: "https://96e03fa6c292469a-172-245-86-254.serveousercontent.com" - Chai-Max Wallet Theft Indicators in src/index.js: ".exodus" PAYLOAD FILES src/canary.js (+ src/index.js) INDICATORS (IOCs) - domains: hackerone.com, docs.exodus.com - payloadFileHash: 16502b9065d4976ebb34fd49d0fb75f3cd0e64cf8d35872b419a6b6752485d51