GCVE-110-OSM-2026-12092

This package pretends to be a diagnostic utility but instead it just exfiltrates all environment variables to a hard coded IP address and starts a reverse-shell. ENTRY index.js (main: index.js) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) OBFUSCATION - IOCs Found in Deobfuscated Code in dist/SysDiagNode.node.js - Obfuscation patterns: charCodeArrayBuild in dist/SysDiagNode.node.js - recovered 1 ipv4 from decoded/deobfuscated content ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Platform Detection with Data Collection in dist/SysDiagNode.node.js: "JSON.stringify({ v: '1.0.4', nv: process.version, d: _d, t: 'fallback' }); const..." - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES dist/SysDiagNode.node.js