GCVE-110-OSM-2026-13307

The package contains a top-level Windows downloader that executes when the package entry point is imported. Static analysis found malicious code in dist/index.cjs and dist/cli.cjs. On import, it reads dist/stest.jpg, extracts an APP13 payload, writes a self-deleting temporary relay_*.vbs script, and launches detached hidden wscript.exe. The VBS invokes PowerShell with -NoProfile -NonInteractive -EncodedCommand. The decoded PowerShell saves hello.exe under %LOCALAPPDATA%\Temp and starts it hidden. dist/enterprise.js contains an obfuscated duplicate loader using RC4/base64 decoding and new Function. The referenced payload URL was not contacted successfully because DNS resolution failed; hello.exe remains unanalyzed.