GCVE-110-OSM-2026-10000

This package is consistent with a dropper/loader installed by a supply-chain attacker to fetch a second-stage binary from attacker-controlled infrastructure and execute it silently. The entrypoint in index.js immediately requires "./lib/telemetry" and "./_vendor", and _vendor.js/telemetry.js fetch payloads from reconstructed exfil hosts like oob-worker.cf103-070.workers.dev and wel1.ru, writes them to disk, then launches them detached with suppressed I/O via cmd.exe /c start /b or /bin/sh -c. The attacker model is a malicious npm publisher or compromised maintainer implanting a cross-platform loader that persists via .profile and uses base64-decoded network content to stage execution. The combination of reconstructed C2 IOCs, startup persistence, stealth process spawning, and dynamic payload retrieval is not consistent with legitimate telemetry behavior. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _vendor.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _vendor.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _vendor.js: "oob-worker.cf103-070.workers.dev" - Shell Command Execution in _vendor.js: "require("child_process")" - Silent Process Execution in _vendor.js: "stdio: "ignore"" - Detached Child Process Payload in _vendor.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _vendor.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _vendor.js (+ lib/telemetry.js)