GCVE-110-OSM-2026-10025

This looks like a malicious npm loader/dropper targeting developers during install: `index.js` immediately requires `./lib/telemetry` and `./_bridge`, and `_bridge.js` downloads platform-specific payloads from reconstructed C2 hosts before writing them to disk and executing them. The attacker model is a supply-chain compromise/burner package designed to fetch a second-stage binary from `oob-worker.cf100-416.workers.dev` or `3.work`, then run it detached with suppressed I/O via `cmd.exe /c start /b` or `/bin/sh -c ... &`. The persistence and stealth indicators in `lib/telemetry.js` (`.profile`, `detached: true`, `stdio: "ignore"`, `windowsHide: true`, `process.pid`) are consistent with hiding execution and surviving process exit rather than legitimate telemetry. The obfuscated/reconstructed domains plus `https.request`/`https.get` and base64-decoding of dynamic content further corroborate exfiltration and staged payload delivery. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _bridge.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _bridge.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _bridge.js: "oob-worker.cf100-416.workers.dev" - Shell Command Execution in _bridge.js: "require("child_process")" - Silent Process Execution in _bridge.js: "stdio: "ignore"" - Detached Child Process Payload in _bridge.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _bridge.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _bridge.js (+ lib/telemetry.js)