GCVE-110-OSM-2026-10108

This package is consistent with a staged loader designed for a commodity malware operator or compromised-publisher campaign: `index.js` immediately requires `./_helpers`, and `lib/telemetry.js` downloads a binary payload from attacker-controlled infrastructure, writes it to disk, and launches it detached and hidden. The code also persists via a state file in the temp directory, reads environment-sensitive state, and includes fallback DNS-based chunked retrieval from `oob-worker.cf103-070.workers.dev` and `416.workers.de`, which are first-class exfil/C2 indicators. The use of `spawn("cmd.exe" ... stdio: "ignore", windowsHide: true)` and `/bin/sh -c ... &` shows deliberate stealth execution, not normal telemetry. I would treat this as malicious under an attacker model of a hidden cross-platform loader/backdoor delivered through a fake package. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in _helpers.js: "process.env.TMP || "C:\\Windows\\Temp") : "/var/tmp"; let payload = null; const ..." - Network Request in _helpers.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _helpers.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _helpers.js: "oob-worker.cf103-070.workers.dev" - Shell Command Execution in _helpers.js: "require("child_process")" - Silent Process Execution in _helpers.js: "stdio: "ignore"" - Detached Child Process Payload in _helpers.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _helpers.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _helpers.js (+ lib/telemetry.js)