GCVE-110-OSM-2026-10026

This looks like a staged downloader/loader operated by a malicious npm package supply-chain attacker: `index.js` immediately requires `./_bootstrap`, and `_bootstrap.js` fetches a platform-specific binary from the reconstructed C2 domain `oob-worker.cf99-9b3.workers.dev` before writing it to disk and executing it. The code uses stealthy detached process spawning with suppressed I/O in `_activate()` and persistence-like gating via the `flagPath()` marker in `.analytics_state`, which is consistent with an implant that wants to run once and then survive unnoticed. `lib/telemetry.js` reinforces the same attacker model with `https.request()`, `Buffer.from(chunks, "base64")`, and background execution in `cmd.exe`/`/bin/sh`, so this is not a benign analytics client. The package metadata is also burner-like (`no-repository`, `metadata-minimal`), but the decisive evidence is the hidden remote payload retrieval and execution chain, not the metadata alone. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _bootstrap.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _bootstrap.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _bootstrap.js: "oob-worker.cf99-9b3.workers.dev" - Shell Command Execution in _bootstrap.js: "require("child_process")" - Silent Process Execution in _bootstrap.js: "stdio: "ignore"" - Detached Child Process Payload in _bootstrap.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _bootstrap.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _bootstrap.js (+ lib/telemetry.js)