GCVE-110-OSM-2026-14447

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. DESTINATION - 4 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Corporate Environment Targeting in libs/18.2.0.js: "tModified[i]),T.etag[i]&&j.setRequestHeader("If-None-Match" - Data Encoding for Exfiltration in libs/18.2.0.js: "encodeURIComponent(e)+"="+encodeURIComponent(null==n?"":n)};if(null==e)return"";..." OBFUSCATION - IOCs Found in Deobfuscated Code in libs/18.2.0.js - Dynamic Base64 Decoding in libs/18.2.0.js: "atob(e)" - Base64 Encoded Payload in libs/18.2.0.js: ""y7S0oePSwc+owN3OpZyd2r/Gzdq91caBronvlv6YhpD6mIWT/ZiFl/LpmNX274eU54WClueFhI35hYO..." - recovered 4 domains, 4 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Dynamic Code Execution in libs/18.2.0.js: "exec(a)" - Very New NPM Publisher Account PAYLOAD FILES libs/18.2.0.js