GCVE-110-OSM-2026-14365

This package is an example of the greyware Bailey's market. This package does two things that taken together push it into a "malicious" designation: First, it uploads data provided to it to one of four random locations without explictly saying it would do that. Second, it scrapes multiple websites and sends social media urls that it finds to one of two API servers managed by the author ENTRY lib/index.js (main: ./lib/index.js) PERSISTENCE - Startup Persistence in WAProto/AICommon.js: ".profile" - Startup Persistence in lib/Socket/messages-send.js: ".profile" - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" - Startup Persistence in lib/Utils/instagram.js: ".profile" - Startup Persistence in lib/assets/wasm/worker-modules.js: ".profile" DESTINATION - 33 exfil (reconstructed, custom-c2) - 1 c2 (domains) - 2 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/Tiktok.js: "encodeURIComponent(url.trim" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/facebook.js: "encodeURIComponent(url" - Data Encoding for Exfiltration in lib/Utils/instagram.js: "encodeURIComponent(url" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/protocol-debug.js: "Buffer.from(value).toString('base64')" (+8 more) OBFUSCATION - Global Variable Shadowing in lib/Voip/wasm-engine.js: "const module = {" - Global Variable Shadowing in lib/Voip/worker-bootstrap.js: "const module = {" - IOCs Found in Deobfuscated Code in lib/Socket/messages-recv.js - Dynamic Base64 Decoding in lib/Signal/Group/group_cipher.js: "Buffer.from(iv, 'base64')" - Dynamic Base64 Decoding in lib/Signal/Group/sender-key-state.js: "Buffer.from(chainKey, 'base64')" - Whitespace-Padded Hidden Payload in lib/Socket/messages-recv.js: "; const" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, 'base64')" - Dynamic Base64 Decoding in lib/Utils/generics.js: "Buffer.from(val, 'base64')" (+15 more) ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in lib/assets/wasm/worker-modules.js: "https://www.internalfb.com/intern/invariant/2/" - Dynamic Code Execution in WAProto/add-missing-proto-deps.js: "exec(source)" - Platform Detection with Data Collection in lib/Socket/messages-recv.js: "JSON.stringify({ ...child, content: Buffer.isBuffer(child.content) ? child.conte..." - Shell Command Execution in lib/Utils/messages-media.js: "require("child_process")" - Dangerous Function Calls in lib/Voip/worker-bootstrap.js: "require("vm")" - XOR-Encoded String Arrays in lib/assets/wasm/loader.js: "var r=[0,97,115,109,1,0,0,0,1]" PAYLOAD FILES lib/assets/wasm/worker-modules.js (+ lib/Socket/messages-recv.js, lib/Voip/worker-bootstrap.js)