GCVE-110-OSM-2026-9507

The entrypoint src/index.js re-exports a set of constants whose names strongly suggest infostealer infrastructure: APPDATA, ROAMING, LOCAL, TEMP, USERPROFILE_ENV are Windows credential-path constants; LEXTS/SEXTS (likely 'large/small extensions'), LSTOR, LDB, DBS, LPEXT_ID, BRS are consistent with browser extension enumeration, LevelDB database access, and browser credential stores — a classic Chromium-based credential harvesting pattern. The export of `textToIp` is an unusual utility in this context and may serve C2 encoding. The static analyzer did not surface the actual content of constants.js, config.js, or text_to_ip.js, so the exfil mechanism is not yet confirmed. However, the combination of a burner package (no description, no repo, generic name 'test-dev-config') with exports whose naming is essentially the vocabulary of a Windows browser infostealer warrants escalation. ENTRY src/index.js (main: ./src/index.js)