{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-OSM-2026-14819","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-04-29T20:31:09Z","dateUpdated":"2026-11-10T17:07:21Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"This package pretends to be the legitimate NPM package \"redeem-onchain-sdk\". The malware employs multi-layer obfuscation (AES-256-CTR + XOR) to hide its malicious functionality and performs credential theft targeting sensitive configuration files, followed by the exfiltration of encrypted data to a remote C2 server.\n\nPayload: dist/index5_test.js\n\nKey findings:\n1. This malicious package steals these environment Variables:\n   - .env\n   - .home/.env\n   - .home/.aws/credentials (AWS)\n   - .home/.docker/config.json (Docker registries)\n   - .home/.ssh/id_rsa (Private SSH keys)\n   - .home/.ssh/config (SSH configuration)\n   - .home/.netrc (Network authentication)\n   - .home/.npmrc (NPM configuration)\n   - AppData/ssh/known_hosts (Windows)\n   - LocalAppData/Google/Chrome/User Data/Default/Login Data (Windows Chrome passwords)\n   - /tmp/session_temp.json (Unix temporary sessions)\n2. This malware writes to a local log file, .redeem_err.log\n3. Also writes an SSH public key to the local home directory of the compromised user\n4. After installation, the malware overwrites the package.json file with a benign version to hide its tracks.\n\nThe payload file used the same \"OrDeR_7077\" encryption key as the Axios payload, and the internal number string 4.2.1, which was the same version used by the Axios payload package, plain-crypto-js.\n\nIOCs:\n- urls: https://18.208.244.120:9999\n- ip: 18.208.244.120\n- file: .redeem_err.log\n- payloadFileHash: ea0d611711059f0d905e97878f05f6e887e71eadbfc783809e5a949bf89e6821","supportingMedia":null}],"references":[{"url":"https://opensourcemalware.com/threats/88ce868a-8699-48b1-b6f2-ac80eb41862b","name":"Malicious npm package: redeem-onchain-sdk","tags":["advisory"]},{"url":"https://registry.npmjs.org/redeem-onchain-sdk","name":"","tags":["vendor"]}],"metrics":[{"format":"CVSS_V3","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Embedded Malicious Code","cweId":"CWE-506","type":"CWE"}]}],"affected":[{"vendor":"unknown","product":"redeem-onchain-sdk","collectionURL":"https://registry.npmjs.org","packageName":"redeem-onchain-sdk","repo":"","defaultStatus":"affected","versions":[{"version":"all","status":"affected","versionType":"","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}