GCVE-110-OSM-2026-10006

This package is a Windows-targeted malware dropper masquerading as the legitimate Anchor Solana framework. The postinstall.js entrypoint uses hex-escape obfuscation to hide its behavior: it fetches a ZIP archive from the attacker-controlled URL, writes it to `C:\Windows\Temp`, extracts it via a silently-invoked PowerShell `Expand-Archive` command (`-NoProfile -NonInteractive`, `windowsHide:true`, `stdio:'ignore'`), then recursively scans the extracted directory for any `.exe` file and spawns it detached with all output suppressed. This is a textbook supply-chain dropper: download, unpack, execute, and clean up the ZIP. The publisher `cleungon` (account age ~0.4 days) has a publisherMaliciousRatio of 1.0 with the only other package `@rbx-ts/services` already confirmed critical in OSM, establishing a clear pattern of malicious publishing activity. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json OBFUSCATION - Decoded Hex Escape Content in scripts/postinstall.js (x11) - Hex Encoded Strings in scripts/postinstall.js: "'\x63\x68\x69\x6c\x64\x5f\x70\x72\x6f\x63\x65\x73\x73'" - Unicode Escape Obfuscation in scripts/postinstall.js: "\x63\x68\x69\x6c\x64\x5f\x70\x72\x6f\x63\x65\x73\x73" - Obfuscation (osm-deobfuscator): unknown in scripts/postinstall.js - Obfuscation patterns: hexHeavy in scripts/postinstall.js - recovered 1 paths, 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Silent Process Execution in scripts/postinstall.js: "windowsHide:true" - Very New NPM Publisher Account - Publisher Has Other Malicious Packages - Malicious Dependency Detected in package.json SECOND STAGE HASH dropp.exe - 5b1044b63801916cc026048cb35dcb69521796fc333d0836f501020dffea57c3 PAYLOAD FILES scripts/postinstall.js