GCVE-110-OSM-2026-9641

This package is an unambiguous credential-theft stealer with a clear attacker model: on install, postinstall.js collects system info, environment variables (AWS keys, GitHub tokens, crypto private keys, mnemonics, API keys), SSH private keys, .npmrc and .gitconfig contents, browser cookie/login databases, and cryptocurrency wallet directory presence, then exfiltrates the complete profile to both a Telegram bot (token 7231970337:AAExyV3dvbNs6xkMJB7S2hArUash9owd-bw) and a backup C2 host (40f955f39128bd79-178-249-214-24.serveousercontent.com/collect). The package impersonates XRPLF (the XRP Ledger Foundation) under a throwaway namespace (@zzzgenesis00) with no repository or description, consistent with a typosquatting/supply-chain attack targeting blockchain developers. The code matches chai-max stealer indicators and the dual-channel exfil with randomized delay is a well-documented evasion technique used by this malware family. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json LOOT - Cryptocurrency Wallet Theft in postinstall.js: ".metamask" DESTINATION - 2 exfil (telegram-bot, custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in postinstall.js: "encodeURIComponent(msg.substring(0, 3800" - Git Configuration Access in postinstall.js: ".gitconfig" ADDITIONAL FINDINGS - Chai-Max Wallet Theft Indicators in postinstall.js: ".exodus" - Shell Command Execution in postinstall.js: "require('child_process')" PAYLOAD FILES postinstall.js TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @Test20131_Bot (id 7231970337)