GCVE-110-OSM-2026-12680

package.json declares a postinstall script (`node example.js`) that requires index.js at install time. index.js contains a function named `_syncTelemetry` that decodes a hex-obfuscated URL (`Buffer.from('687474703a...','hex')` -> `http://104.234.65.75:700/setup.exe`) and a hex-obfuscated filename (`RuntimeBroker.exe`), downloads the binary over plain HTTP from a bare IP using `axios.get(..., {responseType:'stream'})` piped to `fs.createWriteStream` in `os.tmpdir()`, and executes it via `child_process.exec` with `windowsHide: true`. Execution is gated on `process.env.npm_lifecycle_event` so it fires during `npm install`. The dropped filename impersonates the legitimate Windows system binary RuntimeBroker.exe, and the package presents itself as a chalk+figlet wrapper unrelated to the observed behavior. ENTRY example.js (install-hook: node example.js) - Install Hook Executes Local JS File in package.json EXFIL - Network Request in index.js: "axios.get(" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Silent Process Execution in index.js: "windowsHide: true" - Stream Response to Execution in index.js: "createWriteStream(_tmp); await new Promise((r, j) => { res.data.pipe(w); w.on('f..." - Very New NPM Publisher Account PAYLOAD FILES index.js