GCVE-110-OSM-2026-10019

This package is a staged loader for an attacker-controlled payload, not a benign analytics library. The entrypoint imports `./lib/telemetry`, which immediately runs `init()` and fetches a binary from reconstructed C2 hosts like `oob-worker.cf100-416.workers.dev`, falling back to TXT-based retrieval and then writing/executing the payload via detached `cmd.exe` or `/bin/sh`. It also shows environment-variable handling (`process.env.TEMP`, `TMP`) alongside `https.request`/`https.get`, stealthy `stdio: "ignore"`, persistence via `.profile`, and anti-analysis checks, which together match a malware operator model focused on remote code delivery and persistence on victim machines. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in _compat.js: "process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/var/tmp"; let co..." - Network Request in _compat.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _compat.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _compat.js: "oob-worker.cf100-416.workers.dev" - Shell Command Execution in _compat.js: "require("child_process")" - Silent Process Execution in _compat.js: "stdio: "ignore"" - Detached Child Process Payload in _compat.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _compat.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _compat.js (+ lib/telemetry.js)