GCVE-110-OSM-2026-14461

nulio-connector@1.1.17 is a high-privilege remote 1C integration agent that establishes persistent Windows autostart, inventories local 1C databases, stores and decrypts credentials, and accepts authenticated relay commands to query, export, and modify business data. Static analysis found no hidden payload downloader or arbitrary code-execution path; however, unauthorized installation, pairing, or compromise of its Nulio control account could enable persistent access to sensitive ERP and accounting systems. ENTRY bin/nulio-connector.js (bin: bin/nulio-connector.js) PERSISTENCE - Startup Persistence in dist/learning/service.js: ".profile" - Startup Persistence in dist/learning/store.js: ".profile" EXFIL - Fetch and Eval/Exec in dist/server/study-fetch.js: "Fetch(d, inner) { return async (url, init) => { const m = ADDRESS.exec" - Data Encoding for Exfiltration in dist/command-path.js: "Buffer.from(script, "utf16le").toString("base64")" - Data Encoding for Exfiltration in dist/discovery.js: "encodeURIComponent(variant" - Data Encoding for Exfiltration in dist/identify/admin-login.js: "Buffer.from(`${this.username}:${this.#password}`, "utf8").toString("base64")" - Data Encoding for Exfiltration in dist/identify/identify.js: "encodeURIComponent(entity)}?${query}&$format=json" - Data Encoding for Exfiltration in dist/intake/mailbox.js: "encodeURIComponent(messageId" - Data Encoding for Exfiltration in dist/learning/odata-client.js: "Buffer.from(`${user}:${password}`, "utf8").toString("base64")" - Data Encoding for Exfiltration in dist/login/key-store.js: "Buffer.from(JSON.stringify({ v: 1, publicJwk, pkcs8: Buffer.from(pkcs8).toString..." (+25 more) OBFUSCATION - Dynamic Base64 Decoding in dist/attachments/read.js: "Buffer.from(b64, "base64")" - Strings Extracted from Deobfuscated Code in dist/attachments/read.js ADDITIONAL FINDINGS - Dynamic Code Execution in dist/autostart.js: "exec(line)" - Silent Process Execution in dist/autostart.js: "stdio: "ignore"" - Platform Detection with Data Collection in dist/launch.js: "JSON.stringify({ code_sha256: hash, at: new Date().toISOS" - Very New NPM Publisher Account - Binary: Process in bin/nulio-connector-host.exe: "set_UseShellExecute" - Binary: Network IOCs Detected in bin/nulio-connector-host.exe: "1.0.0.0" PAYLOAD FILES dist/login/key-store.js (+ dist/autostart.js, dist/recipes/run.js)