GCVE-110-OSM-2026-14060

On install, package.json's postinstall hook runs install.js, which invokes `npm install @conduit/logview-cli@2.2.0 --registry <URL>` where the registry URL is stored as a base64+XOR-masked string in lib/toolchain.json and decoded in memory by lib/origin.js (XOR key `c0ndu1t-ops`). The decoded destination is a plain-HTTP bare IP (http://139.196.94.195:8080/dl/npm/), not the public npm registry, a known publisher host, or an internal-DNS name consistent with the package's self-claimed `conduit.internal` provenance. npm will fetch and execute the lifecycle scripts of whatever package the attacker serves at that endpoint, giving arbitrary install-time code execution on the installer's host. A comment in lib/origin.js states the masking is intended so the downloaded package `carries no readable address`, confirming the concealment is deliberate rather than incidental. ENTRY install.js (install-hook: node install.js) - Install Hook Executes Local JS File in package.json PERSISTENCE - Startup Persistence in bin/logview-archive.js: ".profile" - Startup Persistence in src/core/envelope.js: ".profile" - Startup Persistence in src/core/kdf.js: ".profile" - Startup Persistence in src/core/keyring.js: ".profile" - Startup Persistence in src/core/stream.js: ".profile" - Startup Persistence in src/core/vault.js: ".PROFILE" - Startup Persistence in types/index.d.ts: ".Profile" EXFIL - System Information Collection in index.js: "process.platform" - System Information Collection in install.js: "process.platform" OBFUSCATION - Dynamic Base64 Decoding in lib/origin.js: "Buffer.from(blob, 'base64')" - Deobfuscation Failed in lib/origin.js ADDITIONAL FINDINGS - Shell Command Execution in install.js: "require('child_process')" - Silent Process Execution in install.js: "stdio: 'ignore'" - Dynamic Code Execution in src/core/keyring.js: "exec(candidate)" - Very New NPM Publisher Account PAYLOAD FILES install.js (+ src/core/keyring.js, src/formats/ndjson.js)