GCVE-110-OSM-2026-9309

The entrypoint `apps/docs/app/theta.ts` explicitly reads two cryptographic key files (`rsa.db`, `des.db`) via `readFileSync` and exports them as `rsaKey` and `desKey`. Legitimate packages do not ship raw RSA/DES key material as `.db` files or export read key bytes — this pattern is consistent with a package that either ships attacker-controlled key material for later use or reads victim-side key stores, in either case as a precursor to a crypto-keyed exfiltration scheme. This is compounded by a brand-new single-package publisher (`hallisaacpna555`), four versions published within ~2.5 hours on the same day, no linked source repository, and an unidentified IP literal `3.5.7.9`. The Next.js boilerplate URLs in the IOCs suggest the package wraps scaffolded code to appear legitimate. No explicit exfil endpoint was recovered in this version, but the exported key material and the velocity of version publishing are consistent with an ongoing campaign building toward a payload delivery in a later version. ENTRY apps/docs/app/theta.ts (main: ./app/theta.ts) ADDITIONAL FINDINGS - Rapid Version Publishing INDICATORS (IOCs) - ipv4: 3.5.7.9 - urls: https://nextjs.org, https://nextjs.org/docs/app/api-reference/create-next-app, https://nextjs.org/docs/app/building-your-application/optimizing/fonts, https://nextjs.org/docs, https://nextjs.org/learn (+7 more) - domains: nextjs.org, vercel.com, json.schemastore.org