GCVE-110-OSM-2026-9632

Compromised npm package infected via worm propagation in the Shai-Hulud/ChainDrop supply chain attack (Aug 4, 2026). Malicious versions contain obfuscated preinstall scripts (setup.mjs, math_init.js) that download the Bun runtime and execute a credential-harvesting payload targeting npm tokens, GitHub tokens, AWS credentials, Kubernetes secrets, Vault tokens, Stripe keys, Slack tokens, SSH keys, and sensitive files. Exfiltrates encrypted data via Ethereum dead-drop C2. Malicious payload found in: setup.mjs, math_init.js\nTrigger: preinstall script in package.json\nBehavior: Downloads Bun runtime, executes obfuscated infostealer payload targeting npm/GitHub/AWS/K8s/Vault/Stripe/Slack credentials and sensitive files. Exfiltrates via Ethereum dead-drop C2. Self-propagating worm infects other maintainers packages.\nCompromised versions: 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7, 38.1.8, 38.1.9, 38.1.10, 38.1.11, 38.1.12, 38.1.13, 38.1.14