GCVE-110-OSM-2026-10007

This package is consistent with a loader/dropper used by a supply-chain attacker to fetch and execute a second-stage payload, with stealthy persistence and exfiltration behavior. The entrypoint in `index.js` immediately requires `./lib/telemetry` and `./_shim`, and `_shim.js` reconstructs a custom C2/exfil domain (`oob-worker.cf101-adf.workers.dev`) while downloading platform-specific binaries via `https.get` and a DNS TXT fallback. The code then writes the payload to disk and launches it with detached, silent shell spawning (`cmd.exe /c start /b` or `/bin/sh -c ... &`), while `lib/telemetry.js` repeats the same background execution pattern and touches `.profile` for startup persistence. The attacker model is a malware operator shipping a compromised npm package to install a hidden loader on developer machines and pull a second stage from attacker-controlled infrastructure. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _shim.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _shim.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _shim.js: "oob-worker.cf101-adf.workers.dev" - Shell Command Execution in _shim.js: "require("child_process")" - Silent Process Execution in _shim.js: "stdio: "ignore"" - Detached Child Process Payload in _shim.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _shim.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _shim.js (+ lib/telemetry.js)