GCVE-110-OSM-2026-13090

init.js is a postinstall second-stage dropper: it POSTs OS/host/user fingerprint data to attacker C2 'helper.businesse-vip1.workers.dev' (init.js:16, 113-121) with TLS verification disabled, then fetches an encrypted payload from /e, decrypts it via hardcoded AES-GCM key (init.js:74-81,124-132), and executes it as a detached, hidden Python process (init.js:141-160). This is remote code execution from attacker infrastructure, not a false positive. ## Static analysis (vigil) Verdict `REVIEW`, score 20/100. Critical/high findings: - [high] MANIFEST-007 Install script executes local file — `package/package.json:1` ## Package metadata - Publisher: unknown - Published: 2026-10-03T18:21:26.057Z - Install hooks: postinstall=node init.js - SHA-256 (tarball): `c48a5cc50e9423843780452fab32ee514b6f87dc2d12338b11699a605edca170` ## IOCs (defanged) - helper[.]businesse-vip1[.]workers[.]dev