GCVE-110-OSM-2026-14065

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ENTRY bin/factiii-runner.js (bin: ./bin/factiii-runner.js) DESTINATION - 71 exfil (reconstructed, custom-c2) - 1 c2 (domains) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in dist/cli.js: "process.env) { const sock = env.FACTIII_SECRETS_SOCK; const token = env.FACTIII_..." - Corporate Environment Targeting in index/index.js: "tMode)(it2, `property ${prop} matches pattern ${pat} (use allowMatch" - System Information Exfiltration in dist/cli.js: "__dirname, "..", "vendor", binaryName); if (!(0, import_fs4.existsSync)(src)) { ..." - Data Encoding for Exfiltration in dist/cli.js: "Buffer.from(opts.auth).toString("base64")" - Data Encoding for Exfiltration in index/index.js: "btoa(" - System Information Collection in dist/cli.js: "os.homedir()" - System Information Collection in index/index.js: "process.platform" OBFUSCATION - Dynamic Base64 Decoding in dist/cli.js: "atob(base643)" - Dynamic Base64 Decoding in index/index.js: "atob(m)" - String Array Obfuscation in dist/cli.js: "[ "#0000CC", "#0000FF", "#0033CC", "#0033FF", "#0066CC", "#0066FF", "#0099CC", "..." - Unicode Escape Obfuscation in dist/cli.js: "\u200A\u202F\u205F\u3000\uFEFF" - Base64 Encoded Payload in index/index.js: ""T1RUTwALAIAAAwAwQ0ZGIDHtZg4AAAOYAAAAgUZGVE1lkzZwAAAEHAAAABxHREVGABQAFQAABDgAAAA..." - String Array Obfuscation in index/index.js: "["thin", "extralight", "ultralight", "demilight", "semilight", "light", "book", ..." - Unicode Escape Obfuscation in index/index.js: "\u00a0\u00b5\u037e\u0eb3\u2000" - Obfuscation patterns: stringArrayAccess, charCodeArrayBuild, arrayRotate, charCodeChain, unicodeHeavy, hexHeavy in index/index.js (+2 more) ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in dist/cli.js: "https://github.com/factiii/skills" - Dynamic Code Execution in dist/cli.js: "exec(val)" - Shell Command Execution in dist/cli.js: "child_process").spawn" - Silent Process Execution in dist/cli.js: "stdio: "ignore"" - Shell Command Variable Setup in dist/cli.js: "Windows npm is npm.cmd, which spawnSync can't exec without a shell. sh" - Platform Detection with Data Collection in dist/cli.js: "JSON.stringify({ json: { name: runnerName, platform: process.platform" (+3 more) PAYLOAD FILES dist/cli.js (+ index/index.js)