GCVE-110-OSM-2026-11888

Install-triggered Node.js backdoor with host reconnaissance, remote JavaScript deployment, and conditional cross-platform persistence. The bundled agent receives controller tasks over an unencrypted WebSocket connection. Additional server-supplied code remains unavailable for analysis. Static analysis of ulid-intel@2.12.3; no sample execution or C2 contact occurred. The existing OSM version_info identifies 3.0.1, which was not analyzed in this session and must be preserved separately. Entry: package.json:43 postinstall validates publish artifacts and runs dist/node/utils.js. utils.js:156-188 skips fewer than four logical CPUs, a live PID in <temp>/.pkg-agent.lock, or pre-existing pkg-agent registration; otherwise it spawns bundled payload.js detached with ignored output. The launcher checks pkg-agent whereas deployed persistence uses MicrosoftSystem64. Configuration: dist/node/payload.js:7897-7921 contains Base64/XOR configuration independently decoded as data. The verified WebSocket destination belongs in verified_iocs. A separate HTTP constant is unused, not a confirmed download route. SERVER_URL overrides the default; heartbeat defaults to 15000 ms. The client uses JSON over unencrypted WebSocket, no configured application authentication, disabled redirects, a 15-second handshake timeout, reconnect backoff/jitter, and up to five concurrent tasks. Reconnaissance: payload.js:7945-8006 and 12584-12640 construct a username-containing agent ID with a shortened Windows MachineGuid, macOS IOPlatformUUID, Linux machine-id, or hostname/platform/MAC-or-CPU hash fallback. Hello and get_system_info expose hostname, platform, architecture, release, OS type, uptime, Node version, CPU count/model, home and working directories, and Linux SSH port from configuration (default 22). Network-interface data is used for identity fallback, not an exfiltration destination. Tasks: payload.js:12383-12435 and 13168-13185 define ping, get_system_info, list_drives, list_dir, deploy_binary, and remove_agent. Drive listing checks Windows drive letters, macOS volumes, or Unix root. Directory listing returns names, types, and sizes; no dedicated arbitrary-file-content upload task was identified. Additional payload: payload.js:12999-13083 receives contentBase64 through deploy_binary, decodes at least 100 bytes, waits ten seconds, writes CommonJS package.json and payload.js using .new/.old replacement files, conditionally registers persistence, launches replacement code with Node, and exits. This is remote executable-content delivery over WebSocket, not a fixed HTTP download. The server-supplied JavaScript is unavailable; its behavior and further downloads remain unresolved. Persistence, conditional on deployment: Windows uses %LOCALAPPDATA%/MicrosoftSystem64/payload.js, MicrosoftSystem64.vbs, a logon scheduled task named MicrosoftSystem64, and HKCU Software/Microsoft/Windows/CurrentVersion/Run fallback. macOS uses ~/Library/Application Support/MicrosoftSystem64/payload.js and ~/Library/LaunchAgents/com.launchkeeper.MicrosoftSystem64.plist with RunAtLoad; data/MicrosoftSystem64.log and data/MicrosoftSystem64_err.log are referenced. Linux uses ${XDG_DATA_HOME:-~/.local/share}/MicrosoftSystem64/payload.js with ~/.config/systemd/user/MicrosoftSystem64.service and an enable-linger attempt; when systemctl is absent it writes ~/.config/autostart/MicrosoftSystem64.desktop. Registration outcomes are not all reliably checked. See payload.js:12850-12998. Removal: payload.js:13085-13166 unregisters platform persistence and deletes the installation directory. Windows drops <temp>/r<timestamp>.vbs to delay folder deletion and self-delete; Unix deletes the installation directory directly after shutdown scheduling. Path audit: local launcher gates, identity fallbacks, reconnaissance tasks, deployment mechanics, all three platform persistence branches, removal scripts, and error/reconnect paths were statically traced. Server-supplied deployment content remains unresolved. Optional external bufferutil/utf-8-validate module contents are unavailable; bundled JavaScript fallbacks exist. No blockchain activity was found. No claim is made about live C2 status, attribution, actual host execution, or payload-chain completeness.