GCVE-110-OSM-2026-10106

This package is consistent with a loader/dropper operated by a malicious publisher, likely targeting npm consumers as a supply-chain delivery vehicle. The entrypoint immediately requires "./_vendor", and that file reconstructs the exfil host oob-worker.cf99-9b3.workers.dev, downloads platform-specific binaries from multiple Cloudflare Workers domains, writes them to temp, and launches them detached with suppressed I/O. The use of persistent marker files under .analytics_state, the .profile startup persistence signal, and the hidden telemetry.js path show deliberate execution and survival after install, not a normal library behavior. The publisher history is especially damning: oplhgbwwku5k has a prior critical malicious package and a 1.0 malicious ratio, matching the attacker model of a compromised or throwaway npm account pushing a trojanized package. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _vendor.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _vendor.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _vendor.js: "oob-worker.cf99-9b3.workers.dev" - Shell Command Execution in _vendor.js: "require("child_process")" - Silent Process Execution in _vendor.js: "stdio: "ignore"" - Detached Child Process Payload in _vendor.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _vendor.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." (+2 more) PAYLOAD FILES _vendor.js (+ lib/telemetry.js)