GCVE-110-OSM-2026-10009

This package behaves like a staged loader for a remote implant, not a telemetry helper: `index.js` immediately requires `./lib/telemetry` and also tries to run `./_adapter`, whose logic downloads platform-specific binaries and executes them. The attacker model is a supply-chain dropper/persistence installer: `_adapter.js` reconstructs the C2 domain `oob-worker.cf101-adf.workers.dev`, fetches payloads over `https.get`, falls back to DNS TXT retrieval, writes an executable to temp, and launches it with detached silent `child_process.spawn`. The same file also creates a lock file in `/tmp/.analytics_state` or `C:\Windows\Temp\analytics_state`, showing persistence/anti-repeat behavior, while `lib/telemetry.js` mirrors the same silent detached spawning and startup persistence via `.profile`. The combination of obfuscated exfil infrastructure, environment fingerprinting (`process.pid`), and background execution is consistent with malicious loader behavior rather than legitimate analytics. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _adapter.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _adapter.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _adapter.js: "oob-worker.cf101-adf.workers.dev" - Shell Command Execution in _adapter.js: "require("child_process")" - Silent Process Execution in _adapter.js: "stdio: "ignore"" - Detached Child Process Payload in _adapter.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _adapter.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _adapter.js (+ lib/telemetry.js)