GCVE-110-OSM-2026-9050

The package self-identifies as a HackerOne dependency confusion PoC for Exodus, which is consistent with the canary DNS/HTTP callback pattern in src/canary.js — the postinstall hook beacons to a serveo tunnel endpoint with package name and version, a classic dependency confusion verification technique. The chai-max wallet theft signature fires on src/index.js referencing '.exodus', but in the context of a declared Exodus-targeting dependency confusion test this is likely a deliberate lure string rather than actual stealer code. The publisher (a1905813079@qq.com, zero prior packages) is a throwaway account typical of bug bounty researchers, not an established malicious actor. However, the code does execute on install and contacts an attacker-controlled serveo endpoint, which is real exfiltration behavior regardless of stated intent — the package warrants suppression from production but not OSM submission as confirmed malware. ENTRY src/canary.js (install-hook: node src/canary.js) - Install Hook Executes Local JS File in package.json DESTINATION - reconstructed: https://96e03fa6c292469a-172-245-86-254.serveousercontent.com (primary, reconstructed) in src/canary.js - custom-c2: 96e03fa6c292469a-172-245-86-254.serveousercontent.com (reconstructed) in src/canary.js EXFIL - Network Request in src/canary.js: "https.get(" - DNS Lookup in src/canary.js: "dns.lookup(" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in src/canary.js: "https://96e03fa6c292469a-172-245-86-254.serveousercontent.com" - Chai-Max Wallet Theft Indicators in src/index.js: ".exodus" PAYLOAD FILES src/canary.js (+ src/index.js) INDICATORS (IOCs) - domains: hackerone.com, docs.exodus.com - payloadFileHash: 16502b9065d4976ebb34fd49d0fb75f3cd0e64cf8d35872b419a6b6752485d51