GCVE-110-OSM-2026-11402

This package is a downloader/launcher for a remote HTA payload: `index.js` fetches a loader from GitHub, writes it to disk, and then executes it with `mshta` in a detached, hidden child process. That is a classic malware loader pattern aimed at persistence-by-survival and stealthy execution on the victim machine, not a legitimate telemetry client. The attacker model is a remote operator controlling the GitHub-hosted HTA payload, with the package acting as the initial stager. The fresh publisher account, one-package history, and MAL advisory `MAL-2026-15586` are fully consistent with that behavior. ENTRY index.js (main: index.js) DESTINATION - 1 exfil (reconstructed) - 1 fetched-payload (domains) (values recorded in verified_iocs) OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn("mshta", [destPath], { detached: true, stdio: "ignore", windowsHide: true,..." - Reconstructed Obfuscated URL in index.js: "https://raw.githubusercontent.com/$Acevatex/Testprogram/main/updater.hta" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn("mshta", [destPath], { detached: true" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES index.js