GCVE-110-OSM-2026-10110

This looks like a malicious dropper/loader aimed at a third-party package consumer, likely a supply-chain attacker using the npm install/import path to execute and persist a hidden payload. The entrypoint `index.js` immediately `require("./_compat")`, and `_compat.js`/`lib/telemetry.js` fetch a binary from `oob-worker.cf101-adf.workers.dev` and related worker domains, write it to disk, then launch it via detached `cmd.exe` or `/bin/sh` with suppressed I/O. The code also performs startup persistence by touching `.profile`, uses environment-gated opt-out checks, and includes anti-analysis signals (`process.pid`, `process.ppid`) plus dynamic base64 decoding in `lib/telemetry.js`. The attacker model is clear: an npm supply-chain implant that downloads a remote payload and executes it stealthily on developer machines. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _compat.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _compat.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _compat.js: "oob-worker.cf101-adf.workers.dev" - Shell Command Execution in _compat.js: "require("child_process")" - Silent Process Execution in _compat.js: "stdio: "ignore"" - Detached Child Process Payload in _compat.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _compat.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _compat.js (+ lib/telemetry.js)