GCVE-110-OSM-2026-10573

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. Judge assessment: The entrypoint `index.js` is a small, normal ULEB128/BCS encoding library, but it conditionally loads `./_perf.js`, and that file is where the suspicious behavior lives. The analyzer flags `_perf.js` for `fetch('https:`, `os.platform()`, `system-info-exfil`, and `platform-detection-with-exfil`, which is consistent with environment fingerprinting and potential data exfiltration rather than a harmless perf helper. The package is also extremely new (`brand-new-package`, `new-npm-account-week`) and has no repository, which increases the likelihood of a dependency-confusion or throwaway-account attacker model, but the actual exfil destination and payload are not visible here, so I cannot call it confirmed malicious with high confidence. The OSV MAL advisory supports concern, but the direct evidence in this scan is still incomplete because `_perf.js` is not shown in full and no concrete IOC is recovered. ENTRY index.js (main: index.js) EXFIL - System Information Exfiltration in _perf.js: "__filename)}catch(e){}} function send(p){try{ fetch" - Network Request in _perf.js: "fetch('https:" - System Information Collection in _perf.js: "os.platform()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in _perf.js: "JSON.stringify({message:x([7, 5, 10, 21, 69, 8]),content:Buffer.from(JSON.string..." - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES _perf.js