GCVE-110-OSM-2026-14435

APT malware detected: Contagious Interview 2026. Associated with threat actor(s): Famous Chollima/UNC5267 (DPRK). Behaviors: data exfiltration, code execution, obfuscated code. EXFIL - Data Encoding for Exfiltration in build-cache.mjs: "btoa(" OBFUSCATION - Dynamic Base64 Decoding in build-cache.mjs: "atob(_0x313c8)" - Obfuscation: function to array replacements in build-cache.mjs - Dynamic Base64 Decoding in cache-sweep.mjs: "atob(_0xf0a19163[" - Dynamic Base64 Decoding in cache-warm.mjs: "atob(_0x9be890207[" - Dynamic Base64 Decoding in workspaces.js: "atob(_0x060c214e7[" - Obfuscation (osm-deobfuscator): obfuscator-io in build-cache.mjs - Base64 Encoded Payload in build-cache.mjs: ""tpbPnc/Xz4eegoOMmYzPwc+Oz9fPrruowN/d39vA2trZ3NjPwc+bz9fP38Pdw9jPkMGWz53P18+bgN/..." - String Array Obfuscation in vendor/tailwindcss/dist/chunk-C2OYBFIH.mjs: "["black","silver","gray","white","maroon","red","purple","fuchsia","green","lime..." (+14 more) ADDITIONAL FINDINGS - Campaign marker: Contagious Interview 2026 in cache-warm.mjs: "_0x1c18" - Silent Process Execution in build-cache.mjs: "windowsHide: true" - Platform Detection with Data Collection in build-cache.mjs: "JSON.stringify({ repos: _0xfe670.repos" - Detached Child Process Payload in cache-warm.mjs: "spawn(_0x45aac.execPath, [_0x165d86e.join(_0x3b0f58d4,_0x012de1)], { detached: t..." - Dynamic Code Execution in vendor/tailwindcss/dist/lib.js: "exec(e)" - Brand New Package (+2 more) PAYLOAD FILES workspaces.js (+ cache-warm.mjs)