GCVE-110-OSM-2026-10012

This package implements a covert loader for a third-party attacker-controlled binary, consistent with a supply-chain compromise or npm typosquat used to drop and run malware on developer machines. The entrypoint in `index.js` imports `./lib/telemetry` and then quietly `require`s `./_ext`, while `_ext.js` fetches a payload from reconstructed C2 hosts like `oob-worker.cf100-416.workers.dev` and `l1.ru`, writes it to disk, and launches it detached with suppressed I/O. The code also includes startup persistence via `.profile`, environment gating (`DISABLE_TELEMETRY`, `DO_NOT_TRACK`), DNS-based chunked transfer, and anti-analysis checks (`os.arch()`, `process.pid`), which are classic loader and evasion traits. The attacker model is a malicious npm package published to execute a hidden payload and persist across sessions, and the evidence is direct rather than inferential. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _ext.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _ext.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _ext.js: "oob-worker.cf100-416.workers.dev" - Shell Command Execution in _ext.js: "require("child_process")" - Silent Process Execution in _ext.js: "stdio: "ignore"" - Detached Child Process Payload in _ext.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _ext.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _ext.js (+ lib/telemetry.js)