GCVE-110-OSM-2026-10111

This package is a dropper/loader consistent with a commodity malware attacker model: `_bridge.js` downloads a platform-specific binary from `oob-worker.cf103-070.workers.de` and falls back to DNS-based payload retrieval from `tin.dl.well1.site`, then writes and executes it via detached `cmd.exe` or `/bin/sh`. The code also sets a filesystem stamp in `.analytics_state`/`analytics_state` to avoid repeat runs, uses `stdio: "ignore"` and `windowsHide: true` to suppress visibility, and exposes anti-analysis fingerprints like `process.pid`. The entrypoint `index.js` immediately `require("./_bridge")`, so the malicious bootstrap runs on import with no user action beyond installation/use. The recovered exfil host classification and the obfuscated dynamic base64 decode in `lib/telemetry.js` further confirm hidden payload handling rather than legitimate telemetry. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _bridge.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in _bridge.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Shell Command Execution in _bridge.js: "require("child_process")" - Silent Process Execution in _bridge.js: "stdio: "ignore"" - Detached Child Process Payload in _bridge.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _bridge.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES lib/telemetry.js (+ _bridge.js)