GCVE-110-OSM-2026-9221

This package implements a multi-stage credential theft and persistence attack executed on npm install via a postinstall hook. The `from_str_2()` function fetches an SSH public key from the attacker's C2 at `http://95.216.118.146:3001/api/ssh-key` and writes it to the victim's `~/.ssh/authorized_keys`, establishing persistent backdoor access. Simultaneously it retrieves scan/block patterns from the same C2 and uploads matching files from the entire home directory (or all Windows drives) to `http://95.216.118.146:3001/api/v1`. The `from_str_1()` function specifically targets `id.json`, `config.toml`, `.env` files and uploads them with the `process.env.USER` prepended to `http://95.216.118.146:3000/api/v1`. The attacker model is clear: supply-chain infection for credential harvesting and persistent SSH backdoor installation, with the innocuous-looking function names (`from_str_1`, `from_str_2`) used as camouflage. ENTRY test.js (install-hook: node test.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://95.216.118.146:3000/api/v1 (primary, plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/ssh-key (plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/scan-patterns (plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/block-patterns (plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/v1 (plaintext) in index.js - custom-c2: 95.216.118.146 (plaintext) in index.js EXFIL - Environment Variable Exfiltration in index.js: "process.env.USER || "unknown"; const payload = Buffer.concat([Buffer.from(`${env..." - Network Request in index.js: "fetch("http:" - System Information Collection in index.js: "os.userInfo()" - Suspicious Domain in index.js: "http://95.216.118.146" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "windowsHide: true" - Platform Detection with Data Collection in index.js: "JSON.stringify({ created, username, publicIp, platform: process.platform" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 816709b97cc4a1c5c0943813d804c3e8dee9e940bfa808bf4b86ddb10fcc523c