GCVE-110-OSM-2026-10028

This package is acting as a malware loader and downloader, with a clear attacker model of stealing execution on install to fetch and launch a secondary payload from a custom C2. The entrypoint `index.js` immediately requires `./_loader`, and `_loader.js` downloads binaries from reconstructed exfil domains like `oob-worker.cf99-9b3.workers.dev` before writing them to disk and executing them via detached, hidden shell commands. `lib/telemetry.js` reinforces the same behavior with startup persistence via `.profile`, `https.request()` network activity, and silent background spawning of a payload that survives parent exit. The presence of obfuscated, reconstructed infrastructure plus anti-analysis hints (`process.pid`) and minimal metadata makes this consistent with a deliberate malicious package, not a normal telemetry library. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _loader.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _loader.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _loader.js: "oob-worker.cf99-9b3.workers.dev" - Shell Command Execution in _loader.js: "require("child_process")" - Silent Process Execution in _loader.js: "stdio: "ignore"" - Detached Child Process Payload in _loader.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _loader.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _loader.js (+ lib/telemetry.js)