GCVE-110-OSM-2026-9215

This package impersonates a Theta blockchain library (claiming authorship by 'Theta Labs') but was published by a brand-new account (`sto-analyze` / `ju.anariasgallego73@gmail.com`) hours before analysis. The attacker model is a crypto wallet stealer: the `crypto-wallet-theft` rule matched 'mnemonic phrase' references in `dist/sigchain-js.umd.js`, which also contains a multi-kilobyte base64 payload blob consistent with an embedded second-stage loader. Across three dist files, the package spawns a detached node child process (`spawn('node', [], { detached: true`) with suppressed I/O — a textbook persistence mechanism that survives parent exit. The UMD bundle is heavily obfuscated with function-to-array, unicode-heavy, hex-heavy, and charCode-chain patterns, and deobfuscation was skipped due to file size (2.1 MB), preventing full payload recovery; the evasion burden alone raises confidence. Taken together — wallet credential harvesting, detached background payload launcher, embedded opaque binary blob, brand-new throwaway publisher account, and rapid dual-version publish — this is an unambiguous crypto wallet stealer targeting Theta blockchain users. LOOT - Cryptocurrency Wallet Theft in dist/sigchain-js.umd.js: "mnemonic phrase" DESTINATION EXFIL - Data Encoding for Exfiltration in dist/sigchain-js.umd.js: "btoa(" OBFUSCATION - Dynamic Base64 Decoding in dist/sigchain-js.umd.js: "atob(textData)" - Obfuscation: function to array replacements in dist/sigchain-js.umd.js - Base64 Encoded Payload in dist/sigchain-js.umd.js: "'AEQF2AO2DEsA2wIrAGsBRABxAN8AZwCcAEwAqgA0AGwAUgByADcATAAVAFYAIQAyACEAKAAYAFgAGwA..." - Obfuscation patterns: charCodeArrayBuild, charCodeChain in dist/sigchain-js.browser.js - Obfuscation patterns: charCodeChain, unicodeHeavy, hexHeavy in dist/sigchain-js.umd.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - XOR-Encoded String Arrays in dist/sigchain-js.browser.js: "var groupSizes = [ 0, 0, 25, 16, 12, 11, 10, 9, 8, 8, 7, 7, 7, 7, 6, 6, 6, 6, 6,..." - Dynamic Code Execution in dist/sigchain-js.cjs.js: "exec(errorMessage)" - Shell Command Execution in dist/sigchain-js.cjs.js: "require('child_process')" - Detached Child Process Payload in dist/sigchain-js.cjs.js: "spawn('node', [], { detached: true" - Brand New Package PAYLOAD FILES dist/sigchain-js.umd.js INDICATORS (IOCs) - ipv4: 13.3.3.7 - emails: fedor@indutny.com - sha256Hashes: 216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a, 6666666666666666666666666666666666666666666666666666666666666658, 7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee, 5363ad4cc05c30e0a5261c028812645a122e22ea20816678df02967c1b23bd72, 79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798 (+45 more) - payloadFileHash: 798a5be3715570c3cfdb308a06bcc5fe60094b151368a0c2e0db98d502c36223