GCVE-110-OSM-2026-10993

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. ENTRY lib/core.js (install-hook: node lib/core.js) - Install Hook Executes Local JS File in package.json LOOT - Discord Token Theft in lib/core.js: "dQw4w9WgXcQ" DESTINATION - 7 exfil (custom-c2, reconstructed) (values recorded in verified_iocs) EXFIL - System Information Exfiltration in lib/core.js: "os.homedir(); // ── Webhook ────────────────────────────────────────────────────..." - Network Request in lib/core.js: "https.request(" - System Information Collection in lib/core.js: "os.homedir()" OBFUSCATION - IOCs Found in Deobfuscated Code in lib/core.js - Dynamic Base64 Decoding in lib/core.js: "Buffer.from(k, "base64")" - recovered 2 urls, 5 domains, 4 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in lib/core.js: "https://github.com/ghysghqgHUJ/.jar/releases/download/v1.0.0/fabric-api-boost-1...." - Dynamic Code Execution in lib/core.js: "exec(json)" - Shell Command Execution in lib/core.js: "spawnSync(" - Very New NPM Publisher Account PAYLOAD FILES lib/core.js