GCVE-110-OSM-2026-10116

This looks like a downloader/loader designed for a compromised package or supply-chain implant, with the attacker model being remote code execution plus stealthy payload delivery. The entrypoint `index.js` immediately `require`s `./_runtime`, and `_runtime.js` fetches a binary from reconstructed C2 infrastructure (`oob-worker.cf101-adf.workers.dev`) over HTTPS, writes it to a temp path, and launches it detached with suppressed I/O via `child_process.spawn(..., stdio: "ignore", detached: true)`. The same file also shows fallback DNS chunk retrieval, environment-gated cache logic, and persistence-like state in `.analytics_state`, which fits a malware loader rather than a telemetry library. The `lib/telemetry.js` path compounds this with identical stealth spawn behavior, `https.request` exfiltration, `Buffer.from(chunks, "base64")` decoding, and `.profile` startup persistence indicators, making the malicious intent clear. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _runtime.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _runtime.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _runtime.js: "oob-worker.cf101-adf.workers.dev" - Shell Command Execution in _runtime.js: "require("child_process")" - Silent Process Execution in _runtime.js: "stdio: "ignore"" - Detached Child Process Payload in _runtime.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _runtime.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _runtime.js (+ lib/telemetry.js)