GCVE-110-OSM-2026-14364

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. ENTRY engine-requirements.js (install-hook: node ./engine-requirements.js) - Install Hook Executes Local JS File in package.json PERSISTENCE - Startup Persistence in WAProto/index.js: ".profile" - Startup Persistence in lib/Socket/chats.js: ".profile" - Startup Persistence in lib/Socket/messages-send.js: ".profile" - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" - Startup Persistence in lib/Utils/message-builder.js: ".profile" DESTINATION - 18 exfil (custom-c2) - 1 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - Corporate Environment Targeting in WAProto/index.js: "tModel != null && Object.hasOwnProperty.call(m, "isLatest" - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/generics.js: "Buffer.from(value?.data || value).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString("base64")" - Network Request in lib/Utils/generics.js: "fetch("https:" - Network Request in lib/Utils/messages-media.js: "request( { hostname: parsedUrl.hostname, port: parsedUrl.port || (parsedUrl.prot..." OBFUSCATION - IOCs Found in Deobfuscated Code in lib/Store/prototype-store.js - IOCs Found in Deobfuscated Code in lib/Utils/message-builder.js - Dynamic Base64 Decoding in lib/Store/prototype-store.js: "Buffer.from(s, "base64")" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, "base64")" - Dynamic Base64 Decoding in lib/Utils/message-builder.js: "Buffer.from(media, 'base64')" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, "base64")" - Unicode Escape Obfuscation in lib/Utils/message-builder.js: "\u004E\u0049\u0058\u0045\u004C" - String Array Obfuscation in lib/WABinary/constants.js: "[ 'alignas', 'alignof', 'and', 'and_eq', 'asm', 'auto', 'bitand', 'bitor', 'bool..." (+4 more) ADDITIONAL FINDINGS - Silent Process Execution in lib/Utils/message-builder.js: "{ silent: true" - Platform Detection with Data Collection in lib/Utils/message-builder.js: "JSON.stringify({ response_id: crypto.randomUUID(), sections })).toS" - Dynamic Code Execution in lib/Utils/rich-message-utils.js: "exec(code)" - Very New NPM Publisher Account PAYLOAD FILES lib/Utils/message-builder.js