GCVE-110-OSM-2026-13617

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY index.js (install-hook: node index.js || true) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in index.js: "https.get(" - System Information Collection in index.js: "os.userInfo()" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Suspicious URL Pattern in Template Literal in index.js: "https://accenture-npm.azurewebsites.net/test?h=${...}&u=${...}" - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES index.js