GCVE-110-OSM-2026-10105

This is consistent with a staged malware loader targeting npm consumers: the package entrypoint immediately requires "./_loader", which downloads a secondary payload from reconstructed exfil/C2 domains and writes it to a temp path before launching it in the background. The attacker model is a supply-chain compromise or malicious publisher using a fake "mobile SDK" to deliver a downloader that fetches from oob-worker.cf101-adf.workers.dev and rs.de, then executes the retrieved binary via detached shell spawning. The presence of env-exfiltration, stealthy process spawning with stdio ignored, startup persistence via .profile, and publisher history tied to devplatform-spa-plugin-s3 makes benign interpretation untenable. Deobfuscated code in lib/telemetry.js shows real operational logic rather than false-positive regex hits, including HTTPS fetches, DNS chunked recovery, and launching dotnet_diag_* binaries. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in _loader.js: "process.env.TMP || "C:\\Windows\\Temp") : "/var/tmp"; let raw = null; const mirr..." - Network Request in _loader.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _loader.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _loader.js: "oob-worker.cf101-adf.workers.dev" - Shell Command Execution in _loader.js: "require("child_process")" - Silent Process Execution in _loader.js: "stdio: "ignore"" - Detached Child Process Payload in _loader.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _loader.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." (+2 more) PAYLOAD FILES _loader.js (+ lib/telemetry.js)