GCVE-110-OSM-2026-10104

This is a downloader/launcher implant consistent with a dependency-confusion attacker model: the package name and inflated version `33.9.5` are designed to outrank an internal package, while `_polyfill.js` fetches a binary from reconstructed C2 `oob-worker.cf102-baf.workers.dev` and `rs.de`, writes it to disk, and executes it. The code in `lib/telemetry.js` uses `https.request`, base64 decoding, detached `cmd.exe`/`/bin/sh` spawning with `stdio: "ignore"`, and startup persistence via `.profile`, which is classic stealthy payload delivery and persistence behavior. `process.ppid`/`process.pid` checks and the cache TTL gating further indicate anti-analysis and rate-limited malware behavior rather than legitimate telemetry. The attacker goal is clear: covertly download, persist, and run a secondary payload on victim machines. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _polyfill.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _polyfill.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _polyfill.js: "oob-worker.cf102-baf.workers.dev" - Shell Command Execution in _polyfill.js: "require("child_process")" - Silent Process Execution in _polyfill.js: "stdio: "ignore"" - Detached Child Process Payload in _polyfill.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _polyfill.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." (+1 more) PAYLOAD FILES _polyfill.js (+ lib/telemetry.js)