GCVE-110-OSM-2026-9647

This package implements a multi-stage attack executed via postinstall hook (test.js → index.js). The attacker model is credential theft combined with persistent SSH backdoor and mass file exfiltration: `from_str_2()` fetches an SSH public key from a C2 url and writes it to `~/.ssh/authorized_keys`, granting the attacker persistent remote access. It then fetches scan/block patterns from the same C2 and recursively walks the filesystem (home directory on Unix, all drives on Windows) to upload matching files to its exfil destination. `from_str_1()` independently searches for `id.json`, `config.toml`, `.env`, and `env` files and uploads them with the current `process.env.USER` prepended to its exfil destination. The package has zero legitimate metadata and the function names (`from_str_1`, `from_str_2`) are deliberate misdirection mimicking Rust idioms to appear innocuous. ENTRY test.js (install-hook: node test.js) - Install Hook Executes Local JS File in package.json DESTINATION - 6 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in index.js: "process.env.USER || "unknown"; const payload = Buffer.concat([Buffer.from(`${env..." - Network Request in index.js: "fetch("http:" - System Information Collection in index.js: "os.userInfo()" - Suspicious Domain in index.js: "http://95.216.118.146" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "windowsHide: true" - Platform Detection with Data Collection in index.js: "JSON.stringify({ created, username, publicIp, platform: process.platform" PAYLOAD FILES index.js