GCVE-110-OSM-2026-10024

This package is consistent with a downloader/launcher implant for an attacker-controlled C2 that fetches a payload from reconstructed domains and executes it silently in the background. The entrypoint immediately requires "./_bootstrap", which contacts oob-worker.cf101-adf.workers.dev and rs.de, writes the retrieved content to a temporary executable, then spawns it detached with stdio suppressed via cmd.exe or /bin/sh. The additional DNS TXT fallback, startup persistence through ".profile", and deobfuscated telemetry logic that hides 124 strings strongly indicate an attacker model focused on payload delivery and persistence on the victim host. There is no legitimate package metadata or repository context to explain this behavior, and the implementation matches a commodity malware loader rather than analytics code. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _bootstrap.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _bootstrap.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _bootstrap.js: "oob-worker.cf101-adf.workers.dev" - Shell Command Execution in _bootstrap.js: "require("child_process")" - Silent Process Execution in _bootstrap.js: "stdio: "ignore"" - Detached Child Process Payload in _bootstrap.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _bootstrap.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _bootstrap.js (+ lib/telemetry.js)