GCVE-110-OSM-2026-10464

This is a trojanized Telegram bot library disguised as a scoped wrapper around telegraf. The `TraceCors.create()` static method calls `bot.telegram.getMe()` to retrieve the victim's bot username, then authenticates against an attacker-controlled GitHub repository (`Vellia-Elyvia/mydb/contents/db.json`) using a hardcoded GitHub PAT to check if the bot is 'registered and active.' This design reveals bot usernames to the attacker (via the GitHub API request and the attacker's control of the repo/token) and gives the attacker a remote kill-switch over any deployed bot — they can revoke access by removing entries from their db. The renamed class (`TraceCors` instead of `Telegraf`) and Indonesian-language comments indicate deliberate obfuscation of the library's true origin and intent. The attacker model is a supply chain implant targeting developers building Telegram bots, establishing persistent attacker-controlled registration gating and identity harvesting. ENTRY lib/cli.mjs (bin: lib/cli.mjs) DESTINATION - 3 exfil (reconstructed, githubTokens) - 1 c2 (domains) (values recorded in verified_iocs) OBFUSCATION - recovered 2 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in lib/telegraf.js: "https://api.github.com/repos/Vellia-Elyvia/mydb/contents/db.json" - Dynamic Code Execution in lib/composer.js: "exec(value)" - Suspicious URL Pattern in Template Literal in lib/telegraf.js: "https://${...}db.json" - Malicious Dependency Detected in package.json PAYLOAD FILES lib/telegraf.js (+ lib/composer.js, src/composer.ts)