GCVE-110-OSM-2026-10112

This looks like a malicious npm supply-chain implant that hides a downloader/loader behind a benign-looking cache package, consistent with a publisher already tied to a critical malicious package. The real entrypoint in `index.js` does a harmless in-memory cache, but it blindly `require("./_compat")`, which contains the payload: hardcoded exfil/C2 domains (`oob-worker.cf99-9b3.workers.dev`, `1.site`), HTTPS downloads, DNS-based payload reconstruction, and detached shell execution via `child_process.spawn`. It also writes startup markers under `.analytics_state`/`analytics_state` and launches the fetched binary with suppressed I/O, matching persistence and stealth for a likely credential- or payload-delivery attacker model in a compromised-package campaign. The static score, reconstructed C2 IOC, and publisher history all converge on deliberate malware rather than a false positive. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _compat.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Deobfuscation Failed in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _compat.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _compat.js: "oob-worker.cf99-9b3.workers.dev" - Shell Command Execution in _compat.js: "require("child_process")" - Silent Process Execution in _compat.js: "stdio: "ignore"" - Detached Child Process Payload in _compat.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _compat.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." (+2 more) PAYLOAD FILES _compat.js (+ lib/telemetry.js)