GCVE-110-OSM-2026-14449

Malicious package detected. Behaviors: data exfiltration, network activity, install-time execution. ENTRY index.cjs (install-hook: node ./index.cjs) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in index.cjs: "process.env.GITLAB_CI ? "gitlab-ci" : process.env.TF_BUILD ? "azure-pipelines" :..." - System Information Exfiltration in index.cjs: "os.hostname(), home_directory: os.homedir(), platform: process.platform, ci_prov..." - Network Request in index.cjs: "https.request(" - System Information Collection in index.cjs: "os.hostname()" - Suspicious Domain in index.cjs: "https://130.162.231.177" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Platform Detection with Data Collection in index.cjs: "JSON.stringify({ test_id: "@sxm-content-creators/tools-ds", hostname: os.hostnam..." - Brand New Package - Rapid Version Publishing PAYLOAD FILES index.cjs