GCVE-110-OSM-2026-10011

This package is a staged downloader/launcher controlled by an attacker model that drops a payload from hidden infrastructure and then persists by spawning it detached. The entrypoint in `index.js` immediately loads `./_init`, and `_init.js` fetches binaries from the reconstructed C2 domain `oob-worker.cf103-070.workers.dev`, falls back to DNS-based retrieval, writes an executable to temp, and runs it with `stdio: "ignore"` and detached shell spawning. The same pattern repeats in `lib/telemetry.js`, which also shows startup persistence via `.profile`, environment-gated activation, and obfuscated network/execution flow; this is consistent with a malicious loader rather than a telemetry library. The recovered IOC classification marks the domain as `custom-c2` with exfil role, so this is not a false positive on generic codeExecution. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in _init.js: "process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/var/tmp"; let bu..." - Network Request in _init.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _init.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _init.js: "oob-worker.cf103-070.workers.dev" - Shell Command Execution in _init.js: "require("child_process")" - Silent Process Execution in _init.js: "stdio: "ignore"" - Detached Child Process Payload in _init.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _init.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _init.js (+ lib/telemetry.js)