GCVE-110-OSM-2026-9290

This package masquerades as a calendar/streak math library but ships a compiled binary (`dist/math-core.bin`) that is copied to the system temp directory and executed on import via a deceptive 'CORE ENGINE INITIALIZATION' block in `dist/index.mjs`. The binary matches the chai-max stealer signature and contains shell scripts that systematically harvest Chrome, Brave, Edge, and Firefox credentials (Login Data, Cookies, key4.db, logins.json). Stolen data is exfiltrated to a hardcoded IP address and a known file-upload endpoint abused for credential staging. The binary also establishes persistence via crontab and `.bashrc` edits. The publisher (`async.coding@protonmail.com`) has zero prior packages and no repository, a classic single-use throwaway account pattern consistent with a supply-chain campaign. ENTRY dist/index.mjs (main: ./dist/index.mjs) LOOT - Browser Data Theft in dist/math-core.bin: "firefox/*/logins.json; do [ -f "$p" ] || continue; PR=$(basename $(dirname "$p")..." PERSISTENCE - Cron Job Persistence in dist/math-core.bin: "crontab -" - Startup Persistence in dist/math-core.bin: ".bashrc" DESTINATION - domains: litterbox.catbox.moe (c2, plaintext) ADDITIONAL FINDINGS - Chai-Max Browser Data Theft in dist/math-core.bin: "BraveSoftware/Brave-Browser microsoft-edge; do for p in ~/.config/$b/*/Login" - Binary: Credential Theft in dist/math-core.bin: "N=0; for b in google-chrome chromium BraveSoftware/Brave-Browser microsoft-edge;..." - Binary: Shell in dist/math-core.bin: "/bin/sh" - Binary: Network IOCs Detected in dist/math-core.bin: "http://%s:%d/Others/%s" PAYLOAD FILES dist/math-core.bin INDICATORS (IOCs) - binaryHashes: 99b03428c57bdde1938bc0ac87153468aef8e82595be02382f3ddbbae5d1880d - payloadFileHash: d59dc87316878e7f66734c3c65707f781609b4c4107e2c96fc2f215b730bbd2c