GCVE-110-OSM-2026-10032

This package is consistent with a loader/dropper attacker model: `index.js` auto-invokes `./lib/telemetry`, which downloads a payload from reconstructed C2 hosts, writes it to disk, and executes it with detached background spawning. The use of `https.get`/`https.request` to `oob-worker.cf101-adf.workers.dev`, `rs.de`, and `l1.ru`, combined with `Buffer.from(parts.join(""), "base64")` and the cache/persistence write to `.analytics_state` and `.profile`, shows deliberate staging and persistence. The `spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore" })` and `/bin/sh -c fp + " &"` paths are classic stealth execution, not normal telemetry. The minimal metadata and the reconstructed exfil domain strongly suggest a malicious package planted to download and run a hidden second stage on developer machines. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _helpers.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _helpers.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _helpers.js: "oob-worker.cf101-adf.workers.dev" - Shell Command Execution in _helpers.js: "require("child_process")" - Silent Process Execution in _helpers.js: "stdio: "ignore"" - Detached Child Process Payload in _helpers.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _helpers.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _helpers.js (+ lib/telemetry.js)