GCVE-110-OSM-2026-10114

This package is consistent with a malware loader operated by a likely attacker/publisher account that already has a critical malicious package, not a legitimate pub/sub adapter. The entrypoint immediately requires "./_platform", which fetches binaries from reconstructed C2/exfil hosts like oob-worker.cf103-070.workers.dev and related domains, writes them to disk, and launches them via detached shell commands with stdio suppressed. The code also shows startup persistence via ".profile", environment gating, and anti-analysis fingerprints (process.pid/process.ppid), all of which fit an implant designed to silently stage and execute payloads. Given the publisherMaliciousRatio of 1 and the recovered custom-C2 IOCs, this is malicious with a clear dropper/loader attacker model. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 4 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _platform.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _platform.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _platform.js: "oob-worker.cf103-070.workers.dev" - Shell Command Execution in _platform.js: "require("child_process")" - Silent Process Execution in _platform.js: "stdio: "ignore"" - Detached Child Process Payload in _platform.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _platform.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." (+2 more) PAYLOAD FILES _platform.js (+ lib/telemetry.js)