GCVE-110-OSM-2026-1451

Suspected dependency confusion attack. Behaviors: data exfiltration, code execution, network activity. Payload: lib/callers.js Secondary files: request.js Key findings: - Environment Variable Exfiltration in lib/callers.js: "process.env.DEV_API_KEY; let retrycnt = 5; while (retrycnt > 0) { ..." - Download and Execute in lib/callers.js: "axios.get(src, { headers: { [k]: v } })).data.Cookie; const handler = new..." - Environment Variable Exfiltration in request.js: "process.env.NODE_DEBUG && /\brequest\b/.test(process.env.NODE_DEBUG) function de..." - Escaped Protocol Pattern in request.js: "'://'" - Shell Command Execution in index.js: "require("child_process")" IOCs: - urls: http://www.apache.org/licenses/, https://nodei.co/npm/request/, https://david-dm.org/request/request, https://snyk.io/test/npm/request, http://mysite.com/obj.json (+21 more) - domains: www.apache.org, nodei.co, david-dm.org, snyk.io, gitter.im (+26 more) - payloadFileHash: 10bfbf32f99c14a1d054faeeb29e169659848fdbd7a9eab37785098cd5eb423f