GCVE-110-OSM-2026-10030

This looks like a staged downloader/loader intended to implant and run a payload on victim machines, with the attacker model being a compromised npm package or malicious publisher distributing a backdoored dependency. The entrypoint in `index.js` immediately requires `./_adapter`, whose `main()` fetches a binary from reconstructed C2 hosts like `oob-worker.cf101-adf.workers.dev` and `er.cf99-9b3.workers.de`, writes it to disk as `.cache_<hex>` or `dotnet_diag_<hex>.exe`, then launches it via detached, silent `spawn()` calls. The same file also uses `.profile` persistence, environment gating, and DNS TXT fallback (`resolveTxt`) to retrieve the payload, which is consistent with covert malware delivery rather than telemetry. The combination of `stealth-process-spawning`, `startup-persistence`, `network-request`, and recovered custom-C2 IOC evidence is sufficient to treat this package as malicious. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _adapter.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _adapter.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _adapter.js: "oob-worker.cf101-adf.workers.dev" - Shell Command Execution in _adapter.js: "require("child_process")" - Silent Process Execution in _adapter.js: "stdio: "ignore"" - Detached Child Process Payload in _adapter.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _adapter.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _adapter.js (+ lib/telemetry.js)