GCVE-110-OSM-2026-9222

This package implements a multi-stage attack executed at install time via postinstall hook running test.js. The attacker model is credential theft and persistence: index.js fetches an SSH public key from the C2 at http://95.216.118.146:3001/api/ssh-key and injects it into ~/.ssh/authorized_keys (addSshKeyToUser), granting the attacker persistent SSH access to the victim machine. Simultaneously, the package retrieves dynamic scan and block patterns from the C2, recursively scans the filesystem (home directory on Unix, all drives on Windows) for matching files (id.json, config.toml, .env), and exfiltrates them with username, platform, and public IP metadata to http://95.216.118.146:3000/api/v1 and http://95.216.118.146:3001/api/v1. The package has zero legitimate metadata, no repository, no description, and obfuscates function names as from_str_1/from_str_2 mimicking Rust idioms to appear benign. The C2 IP 95.216.118.146 is hardcoded in plaintext across five distinct endpoints covering exfil, SSH key delivery, and pattern configuration. ENTRY test.js (install-hook: node test.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://95.216.118.146:3000/api/v1 (primary, plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/ssh-key (plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/scan-patterns (plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/block-patterns (plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/v1 (plaintext) in index.js - custom-c2: 95.216.118.146 (plaintext) in index.js EXFIL - Environment Variable Exfiltration in index.js: "process.env.USER || "unknown"; const payload = Buffer.concat([Buffer.from(`${env..." - Network Request in index.js: "fetch("http:" - System Information Collection in index.js: "os.userInfo()" - Suspicious Domain in index.js: "http://95.216.118.146" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "windowsHide: true" - Platform Detection with Data Collection in index.js: "JSON.stringify({ created, username, publicIp, platform: process.platform" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 816709b97cc4a1c5c0943813d804c3e8dee9e940bfa808bf4b86ddb10fcc523c