GCVE-110-OSM-2026-10117

This looks like a malware-loader dropper targeting npm users, with a clear attacker model: silently fetch a second-stage payload from a custom C2 and execute it in the background. The entrypoint `index.js` immediately requires `./_compat`, and `lib/telemetry.js` then downloads from `oob-worker.cf103-070.workers.dev`, writes an executable to temp, and launches it via detached `cmd.exe`/`/bin/sh` with `stdio: "ignore"`. The code also persists a stamp in the user temp area, does DNS TXT fallback, and hides activity with anti-analysis checks, which is consistent with a staged payload loader rather than legitimate telemetry. Publisher history reinforces intent: `85ngyl11oeq3` already has `devplatform-api-clients` reported malicious, so this package is part of the same malicious publisher pattern. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _compat.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _compat.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _compat.js: "oob-worker.cf103-070.workers.dev" - Shell Command Execution in _compat.js: "require("child_process")" - Silent Process Execution in _compat.js: "stdio: "ignore"" - Detached Child Process Payload in _compat.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _compat.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." (+2 more) PAYLOAD FILES _compat.js (+ lib/telemetry.js)