GCVE-110-OSM-2026-14064

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. LOOT - Browser Data Theft in dist/ui/app.js: "chrome/")?Math.round:nt;function hv(e){e.min=pv(e.min),e.max=pv(e.max)}function ..." PERSISTENCE - Startup Persistence in dist/ui/app.js: ".profile" DESTINATION - 13 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in dist/dev-server.js: "process.env.DIFF_PROBE_FILE ||= uiFile("probe.js"); const params = await Promise..." - Data Encoding for Exfiltration in dist/instrument.js: "encodeURIComponent(options.glyph" - Data Encoding for Exfiltration in dist/ui/app.js: "btoa(" - System Information Collection in dist/dev-server.js: "process.platform" - DNS Lookup in dist/dev-server.js: "dns.lookup(" OBFUSCATION - Dynamic Base64 Decoding in dist/ui/app.js: "aToB(R)" - Obfuscation patterns: unicodeHeavy in dist/ui/app.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in dist/ui/app.js: "https://react.dev/errors/0.35" - Dynamic Code Execution in dist/dev-server.js: "exec(html)" - Shell Command Execution in dist/dev-server.js: "spawnSync(" - Silent Process Execution in dist/dev-server.js: "stdio: "ignore"" - XOR-Encoded String Arrays in dist/instrument.js: "var BAYER = [0, 8, 2, 10, 12, 4, 14, 6, 3, 11, 1, 9, 15, 7, 13, 5]" - Very New NPM Publisher Account PAYLOAD FILES dist/dev-server.js (+ dist/ui/app.js)