GCVE-110-OSM-2026-14399

Malicious package. `self-v8` is an npm package that harvests sensitive data on the victim host and exfiltrates it to an attacker-controlled Discord webhook. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below. ENTRY index.js (main: index.js) DESTINATION - 1 exfil (discord-webhook) (values recorded in verified_iocs) EXFIL - Webhook Data Exfiltration in index.js: "discord.com/api/webhooks/1450251813067423817/XJrDOIGOLOlIW2hsFTo0_BNjcX16FFSYEYH..." - Network Request in index.js: "https.request(" ADDITIONAL FINDINGS - Rapid Version Publishing PAYLOAD FILES index.js