GCVE-110-OSM-2026-10615

The package's postinstall hook (`package.json` → `node init.js`) runs an installer-side dropper. init.js gates on developer-machine heuristics (presence of Desktop/Documents/Downloads directories) and a 24-hour skip marker, then POSTs hostname, username, platform, architecture, Node version, OS release, and package name/version to https://core-js-buffer.domaup-com.workers.dev/report. It then HTTP GETs an AES-256-GCM ciphertext from the same host with TLS verification disabled (`rejectUnauthorized: false`), decrypts it with a key derived from a hardcoded seed, checks the plaintext contains the cover-story string `TelemetrySender`, writes the result to `~/.cache/core-js-buffer/modules/runtime.py`, and spawns Python detached (`stdio:'ignore'`, `.unref()`) to execute it. The package name mimics the legitimate `core-js` library. Behavior is arbitrary remote code execution on the installer's machine, fetched from an attacker-controlled endpoint at npm install time, preceded by installer identifier exfiltration to the same endpoint. Judge assessment: This is an installer-side dropper intended for a developer/workstation attacker model: the `postinstall` hook runs `init.js`, which POSTs host/user/platform telemetry to `core-js-buffer.domaup-com.workers.dev` and then fetches an AES-GCM payload from the same domain for execution. The code decrypts remote content, writes it to `~/.cache/core-js-buffer/modules/runtime.py`, and launches it via detached `python` with `stdio: 'ignore'` and `.unref()`, which is consistent with covert payload execution rather than legitimate setup. The package name `core-js-gns` and metadata like brand-new publisher account `corejsgn` further support impersonation of the `core-js` ecosystem as part of a supply-chain compromise. The OSV advisory is corroborated by the actual `init.js` contents, so this should be treated as confirmed malicious. ENTRY init.js (install-hook: node init.js) - Install Hook Executes Local JS File in package.json EXFIL - Network Request in init.js: "https.request(" - System Information Collection in init.js: "os.userInfo()" ADDITIONAL FINDINGS - Stealth Background Process Spawning in init.js: "spawn(python, [execFile], { detached: true, stdio: 'ignore', windowsHide: true, ..." - Shell Command Execution in init.js: "require('child_process')" - Silent Process Execution in init.js: "stdio: 'ignore'" - Detached Child Process Payload in init.js: "spawn(python, [execFile], { detached: true" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES init.js