GCVE-110-OSM-2026-13210

payload.bundle.min.js:11 hardcodes a webhook.site C2 URL and lines 27-39 use child_process.execSync to run whoami/id/uname -a, exfiltrating the output plus os.hostname and process info (line 44) to the attacker endpoint. The file is disguised as a benign Wix registry stub while the package claims to be a CSS polyfill, and no legitimate function exists for this code. ## Static analysis (vigil) Verdict `BLOCK`, score 27/100. Critical/high findings: - [critical] SC-026 Exfiltration/C2 infrastructure — `package/payload.bundle.min.js:11` ## Package metadata - Publisher: unknown - Published: 2026-10-04T16:13:23.548Z - Install hooks: none found - SHA-256 (tarball): `89de1daa54a36842152ec68e0757fd2c82c0975a56bccf4fd1b469f58d3c7a5c` ## IOCs (defanged) - hxxps://webhook[.]site/5e52603d-f802-4a6f-b91b-43c3a5b45b6b - webhook[.]site