GCVE-110-OSM-2026-11251

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. Judge assessment: This is consistent with a credential-collection or command-and-control stub hidden inside a so-called "security holding package": the default entrypoint `index.js` contains encoded content that decodes to three attacker-controlled HTTPS endpoints (`api.test.qiu577.com`, `api1.test.qiu577.com`, `api3.test.qiu577.com`). The presence of recovered URLs in a base64-wrapped payload, combined with a package name like `@hd-team/app-dnpkg-test` and no source repository, strongly suggests an intentionally obscured loader rather than a normal library. The attacker model is a supply-chain compromise or dependency-confusion lure that phones home to external infrastructure under the `qiu577.com` domain family. The OSV advisory `MAL-2026-14573` is corroborated by the actual hidden IOCs in `index.js`, so this should be treated as confirmed malicious. ENTRY index.js (default-index: index.js) OBFUSCATION - Decoded Base64 Content in index.js - recovered 3 urls, 3 domains from decoded/deobfuscated content PAYLOAD FILES index.js