GCVE-110-OSM-2026-14534

This package does what it says it does which is implement a new Node.js cryptominer. If that's where the story ends we would categorize this as a non-malicious package. The author has added their own crypto wallet to the miner pool in the config ENTRY index.js (main: index.js) DESTINATION - 3 exfil (custom-c2, moneroAddresses) (values recorded in verified_iocs) EXFIL - System Information Collection in index.js: "process.platform" - DNS Lookup in src/js/connect.js: "dns.lookup(" - System Information Collection in src/js/miner.js: "process.platform" - System Information Collection in src/js/topology.js: "process.arch" ADDITIONAL FINDINGS - Shell Command Execution in src/js/fleet.js: "require("child_process")" PAYLOAD FILES src/js/miner.js (+ index.js, src/js/connect.js)