GCVE-110-OSM-2026-9640

This package is a full-featured credential and cryptocurrency wallet stealer executing on install via postinstall.js. The attacker model is supply-chain compromise targeting developers: on npm install, the script harvests hostname, username, environment variables (NPM_TOKEN, AWS keys, MNEMONIC, SEED_PHRASE, wallet private keys), SSH private key metadata, .npmrc, .gitconfig, Chrome/Firefox browser cookie/login data, and wallet directory presence (.metamask, .exodus, .bitcoin, .solana, etc.), then exfiltrates the collected profile to a hardcoded Telegram bot (7231970337:AAExyV3dvbNs6xkMJB7S2hArUash9owd-bw) and a backup C2 at 40f955f39128bd79-178-249-214-24.serveousercontent.com/collect. The package impersonates the legitimate @solana/web3.js under a burner namespace (@zzzgenesis00) with no repository, description, or metadata — a classic typosquat/dependency confusion shape. The code is fully readable and unambiguous; there is no benign explanation for collecting MNEMONIC and SEED_PHRASE and POSTing them to a Telegram bot on install. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json LOOT - Cryptocurrency Wallet Theft in postinstall.js: ".metamask" DESTINATION - 2 exfil (telegram-bot, custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in postinstall.js: "encodeURIComponent(msg.substring(0, 3800" - Git Configuration Access in postinstall.js: ".gitconfig" ADDITIONAL FINDINGS - Chai-Max Wallet Theft Indicators in postinstall.js: ".exodus" - Shell Command Execution in postinstall.js: "require('child_process')" PAYLOAD FILES postinstall.js TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @Test20131_Bot (id 7231970337)