GCVE-110-OSM-2026-10124

This package implements a classic staged dropper. The entrypoint index.js loads both lib/telemetry.js and _shim.js on import. _shim.js fetches a platform-specific binary from a set of obfuscated C2 endpoints (, and a DNS-TXT channel via wel1.ru domains), writes it to a temp directory under a disguised name (dotnet_diag_<hex>.exe on Windows, .cache_<hex> on Linux/macOS), marks it executable, then launches it as a detached background process with stdio suppressed so it survives the parent process and produces no visible output. The DNS-over-TXT fallback channel (txtFetch via et al.) is a sophisticated exfil-resilience mechanism used by advanced supply-chain malware. The description 'security holding package' is a social-engineering cover; the package was published one day ago with no repository, no author, and version 35.8.1 implying a fake legitimacy signal. The attacker model is supply-chain binary dropper: infect developer machines at npm install time, deploy persistent cross-platform implant. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in _shim.js: "process.env.TMP || "C:\\Windows\\Temp") : "/var/tmp"; let binary = null; const h..." - Network Request in _shim.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in _shim.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Reconstructed Obfuscated Domain in _shim.js: "oob-worker.cf101-adf.workers.dev" - Shell Command Execution in _shim.js: "require("child_process")" - Silent Process Execution in _shim.js: "stdio: "ignore"" - Detached Child Process Payload in _shim.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _shim.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES _shim.js (+ lib/telemetry.js)