GCVE-110-OSM-2026-13637

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. ENTRY engine-requirements.js (install-hook: node ./engine-requirements.js) - Install Hook Executes Local JS File in package.json PERSISTENCE - Startup Persistence in WAProto/AICommon/AICommon.js: ".profile" - Startup Persistence in WAProto/BotMetadata/BotMetadata.js: ".profile" - Startup Persistence in WAProto/E2E/E2E.js: ".profile" - Startup Persistence in WAProto/HistorySync/HistorySync.js: ".profile" - Startup Persistence in WAProto/MdStorageMsgRowOpaqueData/MdStorageMsgRowOpaqueData.js: ".profile" - Startup Persistence in WAProto/Web/Web.js: ".profile" - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" - Startup Persistence in lib/Utils/messages.js: ".profile" DESTINATION - 4 exfil (telegram-bot, custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/generics.js: "Buffer.from(value?.data || value).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString("base64")" - Network Request in lib/Telegram/TelegramBot.js: "https.request(" - System Information Collection in lib/Utils/banner.js: "os.platform()" - Network Request in lib/Utils/generics.js: "fetch( "https:" (+1 more) OBFUSCATION - Dynamic Base64 Decoding in lib/Signal/Group/group_cipher.js: "Buffer.from(iv, "base64")" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, "base64")" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, "base64")" - Dynamic Base64 Decoding in src/session_record.js: "Buffer.from(k, 'base64')" - String Array Obfuscation in lib/Utils/messages.js: "['break','case','catch','continue','debugger','delete','do','else','finally','fo..." - Strings Extracted from Deobfuscated Code in lib/Utils/chat-utils.js - Strings Extracted from Deobfuscated Code in lib/Utils/validate-connection.js - Strings Extracted from Deobfuscated Code in src/session_record.js (+1 more) ADDITIONAL FINDINGS - Shell Command Execution in lib/Utils/messages-media.js: "require("child_process")" - Platform Detection with Data Collection in lib/Utils/messages.js: "JSON.stringify({ reference_id: os" - Brand New Package - Rapid Version Publishing PAYLOAD FILES lib/Utils/messages-media.js (+ lib/Utils/generics.js, lib/Utils/chat-utils.js)