GCVE-110-OSM-2026-9218

This package exhibits the FNOS infostealer attacker model: it targets AI developers using Claude Code by embedding a postinstall hook that patches dependency installers, spawns detached background processes with suppressed I/O (bin/lib/auth.mjs, src/main/server.ts), writes persistence to .bashrc (bin/lib/aikey.mjs), and exfiltrates environment variables, git config, and platform info. The smoking-gun IOC is the literal Feishu bot webhook URL `https://open.feishu.cn/open-apis/bot/v2/hook/43a9288c-64b5-4344-9b8f-f27bf75b10ca` in src/main/telemetry/larkCredentials.ts, which matches the FNOS malware family's canonical C2 channel. Two hardcoded Chinese IP literals (47.112.24.153 and 159.75.231.98) corroborate server-side infrastructure. The package's deep integration with the .claude directory tree — reading project configs and session data — confirms it is specifically targeting Claude Code users' AI API keys and credentials. The combination of install-time hook, stealth persistence, env-var and git-config exfil, and Feishu webhook C2 maps cleanly to the FNOS/supply-chain infostealer playbook. ENTRY bin/postinstall.mjs (install-hook: node ./bin/postinstall.mjs) - Hidden NPM Install in bin/lib/runtime.mjs - Hidden NPM Install in bin/lib/update.mjs - Install Hook Executes Local JS File in package.json PERSISTENCE - Startup Persistence in bin/lib/aikey.mjs: ".bashrc" - Startup Persistence in bin/lib/larkCli.mjs: ".profile" - Startup Persistence in bin/lib/navigationCommand.mjs: ".profile" - Startup Persistence in dist-renderer/assets/treemap-GDKQZRPO-CBqWOjcZ.js: ".profile" - Startup Persistence in src/main/utils/shellEnv.ts: ".zshrc" DESTINATION - reconstructed: https://api.github.com/repos/yancyuu/Hermit/releases (primary, reconstructed) in dist/server.bundle.mjs - custom-c2: api.github.com (reconstructed) in dist/server.bundle.mjs - custom-c2: https://ghproxy.net/ (plaintext) in bin/lib/runtime.mjs - custom-c2: https://gh-proxy.com/\uFF09 (plaintext) in dist/server.bundle.mjs - custom-c2: https://yancyuu.github.io/Hermit/ (plaintext) in dist/server.bundle.mjs - custom-c2: https://open.larksuite.com/open-apis/authen/v2/oauth/token (plaintext) in dist/server.bundle.mjs - custom-c2: https://open.feishu.cn/open-apis/authen/v2/oauth/token (plaintext) in dist/server.bundle.mjs - custom-c2: http://engelschall.com (plaintext) in dist-renderer/assets/cytoscape.esm-DsxaTqgk.js (+12 more) EXFIL - Environment Variable Exfiltration in bin/lib/auth.mjs: "process.env.OPENHERMIT_AUTH_OPEN_BROWSER || process.env.OPENHERMIT_OAUTH_OPEN_BR..." - Environment Variable Exfiltration in bin/lib/env.mjs: "process.env.HERMIT_NO_HERMIT_BRIDGE === '1'; export const hermitHome = process.e..." - Environment Variable Exfiltration in bin/lib/exitGuard.mjs: "process.env.AGENTCLI_EXIT_DELAY_MS ?? '', 10); // 100ms suffices for the bare-fe..." - Corporate Environment Targeting in bin/lib/tokenDistribution.mjs: "tModelApiIds) — the full catalog includes // monitoring/test" - Environment Variable Exfiltration in dist/server.bundle.mjs: "process.env.HERMIT_LOG_LEVEL ?? "warn" }, disableRequest" - Corporate Environment Targeting in dist-renderer/assets/cytoscape.esm-DsxaTqgk.js: "tMode:!1,test" - Environment Variable Exfiltration in src/main/server.ts: "process.env.HERMIT_LOG_LEVEL ?? 'warn' }, disableRequest" - Corporate Environment Targeting in src/renderer/components/runtime/ProviderRuntimeSettingsDialog.tsx: "tModels = Object.fromEntries( Object.entries(form.agentModels).filter" (+86 more) OBFUSCATION - Dynamic Base64 Decoding in dist/server.bundle.mjs: "Buffer.from(ciphertext, "base64")" - Dynamic Base64 Decoding in dist/telemetry-worker.bundle.mjs: "Buffer.from(s, "base64")" - Obfuscation: function to array replacements in dist-renderer/assets/architectureDiagram-VXUJARFQ-Bece0RIk.js - Dynamic Base64 Decoding in dist-renderer/assets/cytoscape.esm-DsxaTqgk.js: "atob(r)" - Obfuscation: function to array replacements in dist-renderer/assets/cytoscape.esm-DsxaTqgk.js - Obfuscation: function to array replacements in dist-renderer/assets/haskell-BWDZoCOh.js - Obfuscation: function to array replacements in dist-renderer/assets/javascript-qCveANmP.js - Obfuscation: function to array replacements in dist-renderer/assets/xquery-CQfU5ijd.js (+44 more) ADDITIONAL FINDINGS - Stealth Background Process Spawning in bin/lib/auth.mjs: "spawn(command, commandArgsForPlatform, { detached: true, windowsHide: true, stdi..." - Download Execute Delete Pattern in bin/lib/auth.mjs: "spawn } from 'node:child_process'; import crypto from 'node:crypto'; import path..." - FNOS Crypto-Obfuscated Malware Family in dist/server.bundle.mjs: "open.feishu.cn" - Reconstructed Obfuscated URL in dist/server.bundle.mjs: "https://api.github.com/repos/yancyuu/Hermit/releases" - Shell Command Execution in bin/hermit.mjs: "execSync(" - Silent Process Execution in bin/hermit.mjs: "stdio: 'ignore'" (+7 more) SECONDARY PACKAGES (hidden install) - cc-connect [OSM: clean] in bin/lib/runtime.mjs - -g [OSM: clean] in bin/lib/runtime.mjs - -g [OSM: clean] in bin/lib/update.mjs PAYLOAD FILES dist/server.bundle.mjs (+ src/main/server.ts, bin/lib/auth.mjs) INDICATORS (IOCs) - ipv4: 47.112.24.153, 159.75.231.98 - ipv6: 8::, 3::, 9::, e::, 68:: (+17 more) - urls: https://yancyuu.github.io/agentcli/install.ps1, https://yancyuu.github.io/agentcli/install.sh, https://yancyuu.github.io/agentcli/, http://127.0.0.1:5680`, https://gh-proxy.com/ (+33 more) - domains: yancyuu.github.io, gh-proxy.com, ghproxy.net, yancyyu.github.io, projects.my (+13 more) - emails: dev@openhermit.local, B@X.py, i@q.Ec, c@mI.gz, t@KG.DCjli (+4 more) - payloadFileHash: 29fe225dd74ede1ae2fb8615cbe2615cd27bfa2fbf15bf310520350fe71e742c