GCVE-110-OSM-2026-10516

Malicious package detected. Behaviors: code execution, obfuscated code. ENTRY index.js (main: ./index.js) OBFUSCATION - Obfuscation: augmented proxied array function replacements in build/power-assert-plus.js - Obfuscation (osm-deobfuscator): obfuscator-io in build/power-assert-plus.js - Strings Extracted from Deobfuscated Code in build/power-assert-plus.js - Obfuscation patterns: hexVariables in build/power-assert-plus.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn("node", [powerAssertion, JSON.stringify(args)], { detached: true, stdio: "..." - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn("node", [powerAssertion, JSON.stringify(args)], { detached: true" PAYLOAD FILES index.js (+ build/power-assert-plus.js)