GCVE-110-OSM-2026-10113

This package is consistent with a malware loader / dropper targeting npm consumers: the entrypoint silently requires "./_bootstrap", which downloads a platform-specific binary from attacker-controlled infrastructure and executes it detached in the background. The attacker model is clear: compromise developers or CI by installing a package that stages a payload from custom C2/exfil host `oob-worker.cf102-baf.workers.dev`, with persistence via `.profile` and environment-based opt-out checks to avoid detection. The code in `lib/telemetry.js` and `_bootstrap.js` combines `https.get`, DNS TXT fallback decoding, `Buffer.from(chunks, "base64")`, and suppressed `child_process.spawn` with `stdio: "ignore"`, which is a textbook stealthy loader chain. Publisher history also strongly corroborates intent: `uhx2rzazo7tg` has `publisherMaliciousRatio: 1` and a prior critical malicious package, making this a likely repeated attacker account rather than a false positive. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _bootstrap.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _bootstrap.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _bootstrap.js: "oob-worker.cf102-baf.workers.dev" - Shell Command Execution in _bootstrap.js: "require("child_process")" - Silent Process Execution in _bootstrap.js: "stdio: "ignore"" - Detached Child Process Payload in _bootstrap.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _bootstrap.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." (+2 more) PAYLOAD FILES _bootstrap.js (+ lib/telemetry.js)