GCVE-110-OSM-2026-9220

This package implements a multi-stage attack executed via postinstall hook. The `from_str_2` function fetches an SSH public key from the attacker C2 at `http://95.216.118.146:3001/api/ssh-key` and writes it to `~/.ssh/authorized_keys`, establishing persistent backdoor SSH access. Simultaneously, it retrieves scan/block patterns from the C2 to guide a recursive filesystem crawl, then batch-uploads discovered files to `http://95.216.118.146:3001/api/v1`. The `from_str_1` function independently targets credential files (`id.json`, `config.toml`, `.env`) and exfiltrates them with the `process.env.USER` prepended to `http://95.216.118.146:3000/api/v1`. The package has zero legitimate metadata (no description, no repository, no homepage), a nonsensical name ('api-rust-sdk'), and the attacker model is unambiguous: supply-chain compromise for credential theft, filesystem exfiltration, and persistent SSH backdoor installation. ENTRY test.js (install-hook: node test.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://95.216.118.146:3000/api/v1 (primary, plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/ssh-key (plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/scan-patterns (plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/block-patterns (plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/v1 (plaintext) in index.js - custom-c2: 95.216.118.146 (plaintext) in index.js EXFIL - Environment Variable Exfiltration in index.js: "process.env.USER || "unknown"; const payload = Buffer.concat([Buffer.from(`${env..." - Network Request in index.js: "fetch("http:" - System Information Collection in index.js: "os.userInfo()" - Suspicious Domain in index.js: "http://95.216.118.146" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "windowsHide: true" - Platform Detection with Data Collection in index.js: "JSON.stringify({ created, username, publicIp, platform: process.platform" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 816709b97cc4a1c5c0943813d804c3e8dee9e940bfa808bf4b86ddb10fcc523c