GCVE-110-OSM-2026-14195

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. ENTRY postinstall.js (install-hook: node ./postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Collection in postinstall.js: "os.userInfo()" ADDITIONAL FINDINGS - Stealth Background Process Spawning in postinstall.js: "spawn('cmd', ['/c', 'start', '', 'calc.exe'], { detached: true, stdio: 'ignore' ..." - Shell Command Execution in postinstall.js: "require('child_process')" - Silent Process Execution in postinstall.js: "stdio: 'ignore'" - Detached Child Process Payload in postinstall.js: "spawn('cmd', ['/c', 'start', '', 'calc.exe'], { detached: true" - Brand New Package - Rapid Version Publishing PAYLOAD FILES postinstall.js