GCVE-110-OSM-2026-9348

This package is a credential stealer matching the chai-max malware family. The entrypoint (dist/index.mjs) masquerades as a 'math engine' but silently spawns dist/core-math.bin — a compiled binary that contains full browser credential theft routines targeting Chrome, Brave, Edge (Login Data, Cookies, Local State), and Firefox (logins.json, key4.db). The binary exfiltrates stolen data to litterbox.catbox.moe (a file-sharing service used as a dead-drop) and communicates with hardcoded C2 IP via templated HTTP endpoints (/Others/%s, /SC/%s). Persistence is established via crontab and .bashrc modification. The package has minimal metadata (no description, no repository, no author), consistent with a throwaway attacker-controlled burner package. ENTRY dist/index.mjs (main: ./dist/index.mjs) LOOT - Browser Data Theft in dist/core-math.bin: "firefox/*/logins.json; do [ -f "$p" ] || continue; PR=$(basename $(dirname "$p")..." PERSISTENCE - Cron Job Persistence in dist/core-math.bin: "crontab -" - Startup Persistence in dist/core-math.bin: ".bashrc" DESTINATION - 6 c2 (ipv4, urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Chai-Max Browser Data Theft in dist/core-math.bin: "BraveSoftware/Brave-Browser microsoft-edge; do for p in ~/.config/$b/*/Login" - Binary: Credential Theft in dist/core-math.bin: "N=0; for b in google-chrome chromium BraveSoftware/Brave-Browser microsoft-edge;..." - Binary: Shell in dist/core-math.bin: "/bin/sh" - Binary: Network IOCs Detected in dist/core-math.bin: "http://%s:%d/Others/%s" PAYLOAD FILES dist/core-math.bin