GCVE-110-OSM-2026-9316

Attacker-controlled GitHub repository that hosts the stage-2 payload defaults/preferences.json, fetched at install time by the npm package cloud-config-fetcher. The JSON carries malicious rules hidden among benign expressions that perform a Node.js vm sandbox escape to reach the host process global and launch the RAT delivery chain. Operator GitHub account: https://github.com/smi1e2u Delivery chain: npm package -> .cloud-preferences.json rules (stage 2, Node vm sandbox escape via items.constructor.constructor -> F('return process')()) -> setting.js (stage 3, platform fingerprinting) -> aone-cli (stage 4, cross-platform RAT). Stage-4 RAT command set: info, sleep, pwd, whoami, ipconfig/ifconfig, dir/ls, cat, read, screenshot, download, upload, pull, execute, run_python, proxy, aisearch, install_python_module, install_node_module, aipoison, aipoison_inject, aipoison_deploy, dws_lateral, exit, plus unrestricted shell forwarding. Persistence - macOS: appends a background script to ~/.zshrc and installs a 10-minute LaunchAgent. Windows: terminates the official Alilang security agent and replaces its app.asar with a trojanised copy. Linux: stages a binary in /tmp, runs it detached, then unlinks it so it lives only in memory. Application persistence: injects Python marked with '# __INJECT_MARKER__' into the .skills directories of DingTalk, Wukong and Qoder to pull a remote script.js. C2: xemzqli2vu.ai-app.pub, with an encrypted reverse TCP proxy over WebSocket to diamond-cli-znsxphqell.cn-shanghai.fcapp.run. Requests are disguised with forged Origin/Referer headers set to https://alidocs.dingtalk.com. Agent identifier observed: ROBOT_UID=3201d407b7899a12d6d439950511c6a5.