GCVE-110-OSM-2026-10103

This package is a downloader/launcher implant for a custom-C2 attacker model: `index.js` immediately requires `./_platform`, and `_platform.js` fetches a binary from the reconstructed exfil domain `oob-worker.cf101-adf.workers.dev` before writing it to disk and executing it with hidden detached shell spawning. The code also includes persistence-like behavior via a marker file in `/tmp` or `C:\Windows\Temp` and startup-related matching on `.profile`, which is consistent with maintaining foothold rather than legitimate telemetry. The combination of `https.get`, `https.request`, `Buffer.from(chunks, "base64")`, and silent `child_process.spawn` with `stdio: "ignore"` is classic malware loader behavior, not benign analytics. The minimal metadata and obfuscated/reconstructed IOCs further reinforce that this is a malicious package designed to download and run payloads covertly. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _platform.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _platform.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _platform.js: "oob-worker.cf101-adf.workers.dev" - Shell Command Execution in _platform.js: "require("child_process")" - Silent Process Execution in _platform.js: "stdio: "ignore"" - Detached Child Process Payload in _platform.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _platform.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _platform.js (+ lib/telemetry.js)