GCVE-110-OSM-2026-10364

This is a clear install-time loader for an attacker-controlled payload that executes shell commands, downloads archives, and launches a network attack from the victim machine. The attacker model is a compromise of the npm install path to conscript the host into a DDoS bot and to exfiltrate runtime results to a remote C2 at jasabersama.id. The `postinstall` hook in `package.json` runs `callback.js`, which uses `child_process.execSync`, fetches `mhddos.tgz`, `pyroxy-full.tgz`, and `impacket.tgz`, then starts `UDP/TCP/GET` attacks against `103.118.252.21`. The code also base64-encodes collected output and sends it via an HTTPS request to `/portfolio-data.php`, making the malicious intent explicit. ENTRY callback.js (install-hook: node callback.js) - Install Hook Executes Local JS File in package.json DESTINATION - 5 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in callback.js: "encodeURIComponent('echo ' + b64 + ' | base64 -d >> /tmp/n8n_rce_result.txt" - Data Encoding for Exfiltration in index.js: "encodeURIComponent('echo ' + b64 + ' | base64 -d >> /tmp/n8n_rce_result.txt" - Network Request in callback.js: "https.get(" - Network Request in index.js: "https.get(" ADDITIONAL FINDINGS - Shell Command Execution in callback.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES callback.js (+ index.js)