GCVE-110-OSM-2026-10278

This looks like a Windows persistence and remote-agent deployment package masquerading as a normal npm module: the postinstall hook in `scripts/postinstall.js` force-runs `install({ force: true })` and `ensureService()` to install a boot-start service. The bundled code also performs shell execution with `spawnSync`, hides process windows with `windowsHide: true`, fingerprints the host via `process.platform`/`process.pid`, and encodes payload data with `Buffer.from(script, "utf16le").toString("base64")`, all consistent with stealthy loader behavior rather than a legitimate library. The attacker model here is a burner-account publisher using `npm-support` to ship a persistent Windows agent through install-time execution. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - Data Encoding for Exfiltration in lib/install.js: "Buffer.from(script, "utf16le").toString("base64")" - System Information Collection in bin/bikli.js: "process.platform" - System Information Collection in scripts/postinstall.js: "process.platform" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Shell Command Execution in bin/bikli.js: "spawnSync(" - Silent Process Execution in bin/bikli.js: "windowsHide: true" - Publisher Shows Burner-Account Pattern PAYLOAD FILES lib/install.js (+ bin/bikli.js)