GCVE-110-OSM-2026-10621

Malicious package detected. Behaviors: data exfiltration, code execution. ENTRY bin/cli.js (bin: ./bin/cli.js) - Hidden NPM Install in lib/updater.js: "execSync(`npm install -g ${PKG_NAME}@${version}`" PERSISTENCE - Startup Persistence in lib/command-poller.js: ".profile" - Startup Persistence in lib/nst-manager.js: ".profile" DESTINATION - reconstructed: https://registry.npmjs.org/channel-worker/latest (primary, reconstructed) in lib/updater.js - custom-c2: registry.npmjs.org (reconstructed) in lib/updater.js - custom-c2: https://api.channel.tunasm.art (plaintext) in bin/cli.js - custom-c2: api.channel.tunasm.art (plaintext) in bin/cli.js EXFIL - Data Encoding for Exfiltration in lib/api-client.js: "encodeURIComponent(workerTypes" - Data Encoding for Exfiltration in lib/nst-manager.js: "encodeURIComponent(name)}&page=${page}&limit=100" - System Information Exfiltration in lib/updater.js: "__dirname, '..', 'package.json')); return pkg.version; } async function getLates..." - System Information Collection in bin/cli.js: "os.hostname()" - System Information Collection in lib/cache-server.js: "process.platform" - Network Request in lib/command-poller.js: "fetch('http:" - System Information Collection in lib/command-poller.js: "os.homedir()" - System Information Collection in lib/heartbeat.js: "os.homedir()" (+1 more) OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in lib/updater.js: "https://registry.npmjs.org/channel-worker/latest" - Shell Command Execution in bin/cli.js: "require('child_process')" - Detached Child Process Payload in bin/cli.js: "spawn(process.execPath, [__filename, 'start', '--_daemon'], { detached: true" - Silent Process Execution in lib/cache-server.js: "stdio: 'ignore'" - Platform Detection with Data Collection in lib/cache-server.js: "JSON.stringify({ success: false, message: 'not found' })); } // Find PID(s) hold..." - Dynamic Code Execution in scripts/upload_facebook.js: "exec(text)" SECONDARY PACKAGES (hidden install) - -g [OSM: clean] in lib/updater.js PAYLOAD FILES lib/updater.js (+ lib/nst-manager.js, lib/cache-server.js) INDICATORS (IOCs) - urls: https://down-vn.img.susercontent.com/file/, https://affiliate.shopee.vn/offer/product_offer - domains: affiliate.shopee.vn, down-vn.img.susercontent.com, shopee.vn, cat.group - payloadFileHash: 38bf692bc5ef515830c29dd1903c38318880011ddf0f2d0ee93e94afdbfc60d3