GCVE-110-OSM-2026-10027

This package is consistent with a malicious dropper/loader targeting npm installs: the entrypoint loads `./lib/telemetry` and `./_support`, then `run()` downloads a binary from attacker-controlled infrastructure and executes it detached and silent. The attacker model is clear—persistence and remote payload delivery via `oob-worker.cf102-baf.workers.dev`, `oob-worker.cf103-070.workers.de`, and the DNS-based `dl.wel1.ru` discovery path, with `fs.writeFileSync(savePath, binary)` followed by `cp.spawn(..., { detached: true, stdio: "ignore" })`. The use of `process.pid`/`process.ppid`, `stampPath()` in `.profile`-style state, and `Buffer.from(chunks, "base64")` to reconstruct hidden content shows deliberate stealth and staged execution rather than a legitimate telemetry client. The minimal metadata and throwaway package shape reinforce that this is a supply-chain implant, not a normal library. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _support.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _support.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _support.js: "oob-worker.cf102-baf.workers.dev" - Shell Command Execution in _support.js: "require("child_process")" - Silent Process Execution in _support.js: "stdio: "ignore"" - Detached Child Process Payload in _support.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _support.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _support.js (+ lib/telemetry.js)