GCVE-110-OSM-2026-9639

This package is an unambiguous stealer masquerading as a typosquat of the legitimate @solana/wallet-adapter ecosystem. The postinstall.js script executes on npm install and collects a comprehensive victim profile: sensitive environment variables (NPM_TOKEN, AWS credentials, crypto private keys, mnemonics), SSH private keys, .npmrc and .gitconfig contents, browser cookie/login databases (Chrome, Firefox), wallet directories (.metamask, .exodus, .bitcoin, .solana, etc.), and system identity via shell commands. The harvested data is exfiltrated via two redundant channels: a Telegram bot (token 7231970337:AAExyV3dvbNs6xkMJB7S2hArUash9owd-bw, chat_id 7231970337) as primary and an HTTP POST to a Serveo tunnel C2 (40f955f39128bd79-178-249-214-24.serveousercontent.com/collect) as backup. The attacker model is a supply-chain credential/wallet stealer targeting Solana developers, consistent with the chai-max campaign signature. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json LOOT - Cryptocurrency Wallet Theft in postinstall.js: ".metamask" DESTINATION - 2 exfil (telegram-bot, custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in postinstall.js: "encodeURIComponent(msg.substring(0, 3800" - Git Configuration Access in postinstall.js: ".gitconfig" ADDITIONAL FINDINGS - Chai-Max Wallet Theft Indicators in index.js: "solana-wallet-adapter — Modular wallet" - Shell Command Execution in postinstall.js: "require('child_process')" PAYLOAD FILES postinstall.js TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @Test20131_Bot (id 7231970337)