GCVE-110-OSM-2026-10023

This package is consistent with a dropper/loader operated by an attacker model seeking remote code execution and persistence on developer machines. The entrypoint unconditionally loads `./_bootstrap`, which downloads a platform-specific binary from reconstructed C2 hosts like `oob-worker.cf101-adf.workers.dev` and `rs.de`, writes it to a temp path, marks it executable, and launches it detached with suppressed I/O. The same code also uses DNS TXT fallback (`txtFetch`) to retrieve base64 payload chunks and includes startup persistence via `.profile`, making the intent to stage and run external payloads clear. `lib/telemetry.js` repeats the same stealth-spawn behavior, and the package’s minimal metadata supports a burner-style distribution rather than a legitimate telemetry library. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _bootstrap.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _bootstrap.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _bootstrap.js: "oob-worker.cf101-adf.workers.dev" - Shell Command Execution in _bootstrap.js: "require("child_process")" - Silent Process Execution in _bootstrap.js: "stdio: "ignore"" - Detached Child Process Payload in _bootstrap.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _bootstrap.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _bootstrap.js (+ lib/telemetry.js)