GCVE-110-OSM-2026-9224

This package is a fully operational infostealer and backdoor. On install, the postinstall hook runs test.js which calls two core functions: from_str_1 scans the working directory for credential files (id.json, config.toml, .env) and uploads them with the USER environment variable prepended to a C2 at http://95.216.118.146:3000/api/v1; from_str_2 fetches an SSH public key from http://95.216.118.146:3001/api/ssh-key and injects it into ~/.ssh/authorized_keys via addSshKeyToUser, establishing persistent remote access. The same function also fetches dynamic scan/block patterns from the C2 and performs a full home-directory crawl on Unix or a full drive scan on Windows, batch-uploading discovered files to http://95.216.118.146:3001/api/v1. The attacker model is a supply-chain compromise package designed to exfiltrate secrets and implant an SSH backdoor on the victim machine at install time, with no legitimate use case whatsoever. ENTRY test.js (install-hook: node test.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://95.216.118.146:3000/api/v1 (primary, plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/ssh-key (plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/scan-patterns (plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/block-patterns (plaintext) in index.js - custom-c2: http://95.216.118.146:3001/api/v1 (plaintext) in index.js - custom-c2: 95.216.118.146 (plaintext) in index.js EXFIL - Environment Variable Exfiltration in index.js: "process.env.USER || "unknown"; const payload = Buffer.concat([Buffer.from(`${env..." - Network Request in index.js: "fetch("http:" - System Information Collection in index.js: "os.userInfo()" - Suspicious Domain in index.js: "http://95.216.118.146" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "windowsHide: true" - Platform Detection with Data Collection in index.js: "JSON.stringify({ created, username, publicIp, platform: process.platform" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 816709b97cc4a1c5c0943813d804c3e8dee9e940bfa808bf4b86ddb10fcc523c