GCVE-110-OSM-2026-10013

This package is consistent with a malware loader/persistence implant targeting npm consumers, with the attacker model being a supply-chain dropper that downloads a second stage and launches it covertly. The entrypoint `index.js` immediately requires `./_shim` and `./lib/telemetry`, and `_shim.js` contains HTTPS retrieval from reconstructed exfil/C2 domains (`oob-worker.cf102-baf.workers.dev`, `wel1.ru`) plus a DNS chunked fallback that assembles base64 payloads. The code writes a fresh marker, drops the payload to a temp path, marks it executable, and uses detached `cmd.exe`/`/bin/sh` spawning with `stdio: "ignore"` and `windowsHide: true`, which is classic stealth execution behavior. The presence of `startup-persistence` referencing `.profile`, `process.pid` anti-analysis checks, and a critical static score with `obfuscated-exfil` makes benign telemetry implausible. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _shim.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _shim.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _shim.js: "oob-worker.cf102-baf.workers.dev" - Shell Command Execution in _shim.js: "require("child_process")" - Silent Process Execution in _shim.js: "stdio: "ignore"" - Detached Child Process Payload in _shim.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _shim.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _shim.js (+ lib/telemetry.js)