GCVE-110-OSM-2026-10020

This package is consistent with a loader/dropper operated by an attacker model seeking remote code execution and persistence on developer machines. The entrypoint `index.js` immediately loads `./lib/telemetry` and `./setup`, and `setup.js` fetches a binary from the reconstructed C2 `oob-worker.cf102-baf.workers.dev`, falls back to DNS-based retrieval, writes the payload to disk, and launches it detached. The repeated stealth patterns (`spawn("cmd.exe"... detached: true, stdio: "ignore"`, `/bin/sh -c fp + " &"`) plus startup persistence via `.profile` and hidden state in `.analytics_state` show deliberate concealment, not a normal telemetry library. The dynamic base64 decoding in `lib/telemetry.js` and the recovered exfil domain make the malicious intent concrete rather than speculative. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in lib/telemetry.js: "https.request(" - Network Request in setup.js: "https.get(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in lib/telemetry.js: "spawn("cmd.exe", ["/c", "start", "/b", filePath], { detached: true, stdio: "igno..." - Reconstructed Obfuscated Domain in setup.js: "oob-worker.cf102-baf.workers.dev" - Silent Process Execution in lib/telemetry.js: "stdio: "ignore"" - Detached Child Process Payload in lib/telemetry.js: "spawn("cmd.exe", ["/c", "start", "/b", filePath], { detached: true" - Shell Command Variable Setup in lib/telemetry.js: ""cmd.exe", ["/c", "start", "/b", filePath], { detached: true, stdio: "ignore", w..." - Shell Command Execution in setup.js: "require("child_process")" PAYLOAD FILES setup.js (+ lib/telemetry.js)