GCVE-110-OSM-2026-9216

This package is a credential-theft tool targeting Next.js developers who use OxaPay for cryptocurrency payments. The entrypoint explicitly reads `OXAPAY_GENERAL_API_KEY` and `OXAPAY_PAYOUT_API_KEY` from environment variables, then POSTs them alongside the server's IP address, domain, and other environment-derived metadata to a hardcoded attacker-controlled IP. The attacker model is clear: embed as a 'Next.js server control client', harvest OxaPay API keys from victim environments, exfiltrate them to the C2, and maintain a persistent WebSocket channel for further commands including `process.kill()`. The `verifyProjectImportCoverage` function—which scans all project source files and flags any that do not import this package—serves as a social-engineering hook to maximize deployment surface. Metadata corroborates: brand-new single-package account with a suspicious `.xyz` TLD email, six versions published within two hours, and no prior publisher history. ENTRY dist/index.js (main: dist/index.js) EXFIL - Data Encoding for Exfiltration in dist/index.js: "encodeURIComponent(serverId" - Data Encoding for Exfiltration in src/index.ts: "encodeURIComponent(serverId" - System Information Collection in dist/index.js: "process.platform" - System Information Collection in src/index.ts: "process.platform" ADDITIONAL FINDINGS - Rapid Version Publishing PAYLOAD FILES dist/index.js (+ src/index.ts) INDICATORS (IOCs) - payloadFileHash: 6ab5a327b11ffab4103f78bb3ef960061f8e38c9e4ece2f10751c83e21f93b81