GCVE-110-OSM-2026-13954

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY lib/index.js (main: lib/index.js) PERSISTENCE - Startup Persistence in lib/Modded/message_builder.js: ".profile" - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" - Startup Persistence in lib/assets/wasm/worker-modules.js: ".profile" DESTINATION - 10 exfil (reconstructed, custom-c2) - 1 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString('base64')" - Data Encoding for Exfiltration in lib/assets/wasm/worker-modules.js: "encodeURIComponent(String(e))}).join("&")),n}l.default=s}),98" - System Information Collection in lib/Utils/browser-utils.js: "os.platform()" - Network Request in lib/Utils/messages-media.js: "https.request(" OBFUSCATION - Global Variable Shadowing in lib/VoIP/wasm-engine.js: "const module = {" - Global Variable Shadowing in lib/VoIP/wasm-engine.js.bak: "const module = {" - Global Variable Shadowing in lib/VoIP/worker-bootstrap.js: "const module = {" - IOCs Found in Deobfuscated Code in lib/Modded/message_builder.js - Dynamic Base64 Decoding in lib/Modded/message_builder.js: "Buffer.from(media, 'base64')" - Dynamic Base64 Decoding in lib/Signal/Group/group_cipher.js: "Buffer.from(iv, 'base64')" - Dynamic Base64 Decoding in lib/Signal/Group/sender-key-state.js: "Buffer.from(chainKey, 'base64')" - Dynamic Base64 Decoding in lib/Socket/dugong.js: "Buffer.from(jpegThumbnail, 'base64')" (+16 more) ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in lib/assets/wasm/worker-modules.js: "https://www.internalfb.com/intern/invariant/2/" - Silent Process Execution in lib/Modded/message_builder.js: "{ silent: true" - Platform Detection with Data Collection in lib/Socket/messages-recv.js: "JSON.stringify({ ...child, content: Buffer.isBuffer(child.content) ? child.conte..." - Shell Command Execution in lib/Socket/messages-send.js: "require('child_process')" - Dynamic Code Execution in lib/Utils/rich-messages.js: "exec(line)" - XOR-Encoded String Arrays in lib/assets/wasm/loader.js: "var r=[0,97,115,109,1,0,0,0,1]" (+3 more) PAYLOAD FILES lib/assets/wasm/worker-modules.js (+ lib/Modded/message_builder.js)