GCVE-110-OSM-2026-10010

This package matches a downloader-and-loader attacker model: `index.js` immediately requires `./lib/telemetry` and `./_polyfill`, and the code in `_polyfill.js` fetches platform-specific payloads from reconstructed exfil/C2 infrastructure before writing them to disk and executing them. The hardcoded `oob-worker.cf102-baf.workers.dev` domain is classified as `custom-c2`, while the fallback DNS TXT channel to `*.dl.wel1.ru` plus `Buffer.from(parts.join(""), "base64")` shows deliberate staged retrieval and decoding of remote code. The detached, silent process spawning via `child_process.spawn(... detached: true, stdio: "ignore")` and persistence marker in `.analytics_state` are consistent with malware designed to survive and hide on the victim host. Given the package shape, this is not legitimate telemetry; it is a stealthy dropper/loader likely intended for compromised npm installs or typosquat-driven supply-chain abuse. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _polyfill.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _polyfill.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _polyfill.js: "oob-worker.cf102-baf.workers.dev" - Shell Command Execution in _polyfill.js: "require("child_process")" - Silent Process Execution in _polyfill.js: "stdio: "ignore"" - Detached Child Process Payload in _polyfill.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _polyfill.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _polyfill.js (+ lib/telemetry.js)