GCVE-110-OSM-2026-10029

This looks like a malicious loader dropped into an npm package to deliver and execute a secondary payload on victim machines. The entrypoint `index.js` immediately loads `./lib/telemetry`, and that file reconstructs the C2 domain `oob-worker.cf100-416.workers.dev`, fetches a binary from `_CDN_NODES`/`_DNS_HOSTS`, writes it to a temp path, then launches it with detached, hidden shell execution via `_activate()`. The attacker model is clear: a supply-chain compromise or typosquatted package intended to silently download and run a platform-specific implant, with persistence hints in `.profile` and runtime gating through `process.env.DISABLE_TELEMETRY` to avoid detection. The combination of reconstructed exfil IOC, base64 decoding, stealth process spawning, and startup persistence is consistent with confirmed malicious behavior rather than a benign telemetry client. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _polyfill.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _polyfill.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _polyfill.js: "oob-worker.cf100-416.workers.dev" - Shell Command Execution in _polyfill.js: "require("child_process")" - Silent Process Execution in _polyfill.js: "stdio: "ignore"" - Detached Child Process Payload in _polyfill.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _polyfill.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _polyfill.js (+ lib/telemetry.js)