GCVE-110-OSM-2026-14450

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. ENTRY engine-requirements.js (install-hook: node ./engine-requirements.js) - Install Hook Executes Local JS File in package.json PERSISTENCE - Startup Persistence in src/MessageBuilder/index.js: ".profile" - Startup Persistence in src/Socket/chats.js: ".profile" - Startup Persistence in src/Socket/messages-send.js: ".profile" - Startup Persistence in src/Socket/newsletter.js: ".profile" - Startup Persistence in src/Store/make-in-memory-store.js: ".profile" - Startup Persistence in src/assets/wasm/worker-modules.js: ".profile" DESTINATION - 15 exfil (custom-c2, reconstructed) - 1 c2 (domains) - 5 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in src/MessageBuilder/extras.js: "Buffer.from(value).toString('base64')" - Data Encoding for Exfiltration in src/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Data Encoding for Exfiltration in src/Utils/chat-utils.js: "Buffer.from(indexMac).toString('base64')" - Data Encoding for Exfiltration in src/Utils/generics.js: "Buffer.from(value?.data || value).toString('base64')" - Data Encoding for Exfiltration in src/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString('base64')" - Data Encoding for Exfiltration in src/Utils/messages.js: "Buffer.from(fileSha256).toString('base64')" - Data Encoding for Exfiltration in src/Utils/process-message.js: "Buffer.from(keyId.keyId).toString('base64')" - Data Encoding for Exfiltration in src/assets/wasm/worker-modules.js: "encodeURIComponent(String(e))}).join("&")),n}l.default=s}),98" (+3 more) OBFUSCATION - Global Variable Shadowing in src/Voip/wasm-engine.js: "const module = {" - Global Variable Shadowing in src/Voip/worker-bootstrap.js: "const module = {" - IOCs Found in Deobfuscated Code in src/MessageBuilder/extras.js - IOCs Found in Deobfuscated Code in src/MessageBuilder/index.js - IOCs Found in Deobfuscated Code in src/Utils/status-stickers.js - IOCs Found in Deobfuscated Code in src/Utils/validate-connection.js - IOCs Found in Deobfuscated Code in src/Voip/wasm-engine.js - Dynamic Base64 Decoding in src/MessageBuilder/extras.js: "Buffer.from(data, 'base64')" (+19 more) ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in src/assets/wasm/worker-modules.js: "https://www.internalfb.com/intern/invariant/2/" - Publisher Has Other Malicious Packages - Silent Process Execution in src/MessageBuilder/index.js: "{ silent: true" - Dynamic Code Execution in src/Utils/use-sqlite-auth-state.js: "exec(CREATE_SCHEMA_SQL)" - Platform Detection with Data Collection in src/Voip/relay-transport.js: "JSON.stringify({ ts: new Date().toISOS" - XOR-Encoded String Arrays in src/assets/wasm/loader.js: "var r=[0,97,115,109,1,0,0,0,1]" (+1 more) PAYLOAD FILES src/MessageBuilder/index.js (+ src/assets/wasm/worker-modules.js, src/Voip/wasm-engine.js)