GCVE-110-OSM-2026-14446

Malicious package detected. Behaviors: data exfiltration, code execution. ENTRY lib/index.js (main: lib/index.js) PERSISTENCE - Startup Persistence in lib/lib/client.service.js: ".profile" DESTINATION - 3 exfil (reconstructed, custom-c2) - 1 c2 (domains) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/lib/handler.js: "encodeURIComponent(pass" - Network Request in lib/lib/client.service.js: "got.get(" - Network Request in lib/lib/handler.js: "got.post(" - Network Request in lib/lib/login.bloks.js: "got.post(" - Network Request in lib/lib/login.service.js: "got.get(" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in lib/lib/login.bloks.js: "https://i.instagram.com/api/v1/launcher/sync/" - Dynamic Code Execution in lib/utils/index.js: "exec(url)" - Publisher Has Other Malicious Packages PAYLOAD FILES lib/lib/handler.js (+ lib/lib/login.bloks.js, lib/lib/client.service.js)