GCVE-110-OSM-2026-9574

This package is a credential and cryptocurrency wallet stealer that executes on install via postinstall.js. The attacker model is clear: on npm install, the package collects system fingerprint, sensitive environment variables (AWS keys, crypto private keys, mnemonics, API tokens), SSH private keys, .npmrc and .gitconfig contents, browser cookie/login databases (Chrome, Firefox), wallet directory presence (.metamask, .exodus, .bitcoin, .ethereum, etc.), and exfiltrates everything to a Telegram bot as primary channel and a serveo tunnel C2 as backup. The package masquerades as a BIP39 mnemonic generator — a deliberate lure for cryptocurrency developers — and the obfuscated variable names (_zfg, _jam, _xwl, _cp, _ht) are a thin attempt to evade casual inspection. This matches the chai-max stealer family pattern confirmed by the knownMalware rule hit. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json LOOT - Cryptocurrency Wallet Theft in index.js: "mnemonic phrase" - Cryptocurrency Wallet Theft in package.json: "mnemonic phrase" - Cryptocurrency Wallet Theft in postinstall.js: ".metamask" DESTINATION - 2 exfil (telegram-bot, custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in postinstall.js: "encodeURIComponent(msg.substring(0, 3800" - Git Configuration Access in postinstall.js: ".gitconfig" ADDITIONAL FINDINGS - Chai-Max Wallet Theft Indicators in postinstall.js: ".exodus" - Shell Command Execution in postinstall.js: "require('child_process')" PAYLOAD FILES postinstall.js TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @Test20131_Bot (id 7231970337)