GCVE-110-OSM-2026-10018

This package is a staged downloader/launcher for a custom-C2 payload, consistent with a supply-chain attacker model targeting npm consumers. The entrypoint in index.js immediately loads lib/telemetry and requires ./_platform, where the code fetches binaries from reconstructed exfil domains like oob-worker.cf100-416.workers.dev, writes them to disk, and executes them via detached hidden processes. The same file also tries to persist using a lock file, performs environment-gated behavior, and uses DNS TXT fallback plus base64 reconstruction, which are classic loader traits rather than legitimate telemetry. The combination of env exfiltration, obfuscated infrastructure, and background process spawning is strong evidence of malicious intent. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in _platform.js: "process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/var/tmp"; let da..." - Network Request in _platform.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _platform.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _platform.js: "oob-worker.cf100-416.workers.dev" - Shell Command Execution in _platform.js: "require("child_process")" - Silent Process Execution in _platform.js: "stdio: "ignore"" - Detached Child Process Payload in _platform.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _platform.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _platform.js (+ lib/telemetry.js)