GCVE-110-OSM-2026-14426

Malicious package detected. Behaviors: data exfiltration, code execution. ENTRY bin/cli.js (bin: bin/cli.js) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Collection in bin/cli.js: "os.userInfo()" ADDITIONAL FINDINGS - Stealth Background Process Spawning in bin/cli.js: "spawn(exe, [], { detached: true, stdio: 'ignore' }).unref(); return true; } } cp..." - Shell Command Execution in bin/cli.js: "require('child_process')" - Silent Process Execution in bin/cli.js: "stdio: 'ignore'" - Detached Child Process Payload in bin/cli.js: "spawn(exe, [], { detached: true" - Brand New Package - Rapid Version Publishing PAYLOAD FILES bin/cli.js