GCVE-110-OSM-2026-9223

This package implements a multi-stage attack executed via postinstall hook (test.js → index.js). The attacker model is clear: on install, from_str_2() fetches an SSH public key from the C2 at http://95.216.118.146:3001/api/ssh-key and writes it to ~/.ssh/authorized_keys to establish persistent backdoor access, then retrieves configurable scan/block patterns from the same C2 and recursively exfiltrates matching files (including .env, config.toml, id.json) via batchUpload to http://95.216.118.146:3001/api/v1. Separately, from_str_1() scans cwd for credential and config files and exfiltrates them with process.env.USER prepended to http://95.216.118.146:3000/api/v1. The package has zero legitimate metadata (no description, no repository, no author) and the function names (from_str_1, from_str_2) are deliberately obfuscated to look like innocuous Rust-style utilities. ENTRY test.js (install-hook: node test.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://95.216.118.146:3000/api/v1 (primary, plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/ssh-key (plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/scan-patterns (plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/block-patterns (plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/v1 (plaintext) in index.js - custom-c2: 95.216.118.146 (plaintext) in index.js EXFIL - Environment Variable Exfiltration in index.js: "process.env.USER || "unknown"; const payload = Buffer.concat([Buffer.from(`${env..." - Network Request in index.js: "fetch("http:" - System Information Collection in index.js: "os.userInfo()" - Suspicious Domain in index.js: "http://95.216.118.146" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "windowsHide: true" - Platform Detection with Data Collection in index.js: "JSON.stringify({ created, username, publicIp, platform: process.platform" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 816709b97cc4a1c5c0943813d804c3e8dee9e940bfa808bf4b86ddb10fcc523c