GCVE-110-OSM-2026-14390

Malicious package detected. Behaviors: data exfiltration, obfuscated code. ENTRY lib/index.js (main: ./lib/index.js) PERSISTENCE - Startup Persistence in WAProto/index.js: ".profile" - Startup Persistence in lib/Socket/builder.js: ".profile" - Startup Persistence in lib/Socket/messages-send.js: ".profile" - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in lib/Utils/messages-media.js: "process.env.BAILEYS_CH_LIST_URL || Buffer.from(encoded, "base64").toString("utf-..." - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/generics.js: "Buffer.from(value?.data || value).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString("base64")" - Network Request in lib/Utils/generics.js: "fetch("https:" OBFUSCATION - Decoded Base64 Content in lib/Utils/messages-media.js - Decoded Base64 Content in [deobfuscated] lib/Utils/messages-media.js - Dynamic Base64 Decoding in lib/Socket/builder.js: "Buffer.from(media, 'base64')" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, "base64")" - Dynamic Base64 Decoding in lib/Utils/messages-media.js: "Buffer.from(encoded, "base64")" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, "base64")" - Unicode Escape Obfuscation in lib/Socket/builder.js: "\u004E\u0049\u0058\u0045\u004C" - String Array Obfuscation in lib/WABinary/constants.js: "[ "1724", "profile_picture", "1071", "1314", "1605", "407", "990", "1710", "746"..." (+6 more) ADDITIONAL FINDINGS - Silent Process Execution in lib/Socket/builder.js: "{ silent: true" - Brand New Package - Rapid Version Publishing PAYLOAD FILES lib/Utils/messages-media.js