GCVE-110-OSM-2026-10022

This package behaves like a staged malware loader aimed at supply-chain victims who install the npm package and trigger its main entrypoint. The entrypoint `index.js` immediately requires `./lib/telemetry` and `./_runtime`, and `_runtime.js` downloads a binary from the reconstructed C2 `oob-worker.cf103-070.workers.dev`, writes it to a temp path, marks it executable, and launches it via detached `cmd.exe`/`/bin/sh` with suppressed I/O. The code also persistently writes a stamp file using `process.pid`, probes environment variables like `TEMP`/`TMP`, and uses `https.get`, `https.request`, and `Buffer.from(chunks, "base64")` in a way consistent with hidden payload retrieval and exfiltration. This is malicious under an attacker model of a package compromise or typosquatted supply-chain implant delivering a second-stage loader to developer machines. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in _runtime.js: "process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/var/tmp"; let ra..." - Network Request in _runtime.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Deobfuscation Failed in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _runtime.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _runtime.js: "oob-worker.cf103-070.workers.dev" - Shell Command Execution in _runtime.js: "require("child_process")" - Silent Process Execution in _runtime.js: "stdio: "ignore"" - Detached Child Process Payload in _runtime.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _runtime.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _runtime.js (+ lib/telemetry.js)