GCVE-110-OSM-2026-10109

This package looks like a downloader/dropper for a third-party attacker, not a legitimate telemetry library. The entrypoint `index.js` immediately `require("./setup")`, and `setup.js` fetches payloads from reconstructed custom-C2 hosts such as `oob-worker.cf99-9b3.workers.dev` before writing them to disk and launching them with detached, silent shell execution via `cmd.exe` or `/bin/sh`. It also uses `https.get`, `loadViaDns`, `Buffer.from(..., "base64")`, and startup persistence markers in `.profile`/marker files, which is consistent with covert loader behavior and payload staging. The attacker model is a package-compromise or malicious publisher distributing an npm dependency to silently download and execute secondary malware on developer machines. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 4 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in lib/telemetry.js: "https.request(" - Network Request in setup.js: "https.get(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in lib/telemetry.js: "spawn("cmd.exe", ["/c", "start", "/b", filePath], { detached: true, stdio: "igno..." - Reconstructed Obfuscated Domain in setup.js: "oob-worker.cf99-9b3.workers.dev" - Silent Process Execution in lib/telemetry.js: "stdio: "ignore"" - Detached Child Process Payload in lib/telemetry.js: "spawn("cmd.exe", ["/c", "start", "/b", filePath], { detached: true" - Shell Command Variable Setup in lib/telemetry.js: ""cmd.exe", ["/c", "start", "/b", filePath], { detached: true, stdio: "ignore", w..." - Shell Command Execution in setup.js: "require("child_process")" PAYLOAD FILES setup.js (+ lib/telemetry.js)