GCVE-110-OSM-2026-10014

This package is acting as a dropper/loader for an external attacker-controlled payload: `lib/telemetry.js` downloads binaries from the reconstructed exfil host `oob-worker.cf103-070.workers.dev`, writes them to disk, and executes them via detached `cmd.exe` or `/bin/sh` with suppressed I/O. The code also includes persistence via a `.profile` startup path and anti-analysis markers using `process.pid`, which is consistent with a stealthy malware installer rather than a telemetry library. The attacker model is a supply-chain compromise or trojanized npm package that fetches a second-stage payload from custom C2 infrastructure and launches it silently. The entrypoint in `index.js` requires `./lib/telemetry` and conditionally loads `./_runtime`, so this behavior is reached on package use, not hidden in dead code. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _runtime.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _runtime.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _runtime.js: "oob-worker.cf103-070.workers.dev" - Shell Command Execution in _runtime.js: "require("child_process")" - Silent Process Execution in _runtime.js: "stdio: "ignore"" - Detached Child Process Payload in _runtime.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _runtime.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _runtime.js (+ lib/telemetry.js)