GCVE-110-OSM-2026-14673

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. ENTRY lib/Defaults/index.js (default-index: index.js) - Install Hook Executes Local JS File in package.json: ""preinstall": "node ./engine-requirements.js"" - Postinstall Script in package.json: ""postinstall": "node ./scripts/postinstall.js"" PERSISTENCE - Startup Persistence in lib/Socket/chats.js: ".profile" - Startup Persistence in lib/Socket/messages-send.js: ".profile" - Startup Persistence in lib/Socket/privacy.js: ".PROFILE" - Startup Persistence in lib/WAUSync/Protocols/USyncBusinessProtocol.js: ".profile" DESTINATION - 5 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/generics.js: "Buffer.from(value?.data || value).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/use-sqlite-auth-state.js: "Buffer.from(value?.data || value).toString('base64')" - System Information Collection in bin/charape.js: "process.platform" - Network Request in lib/Utils/generics.js: "fetch('https:" (+1 more) OBFUSCATION - Dynamic Base64 Decoding in lib/Signal/core/session_record.js: "Buffer.from(k, 'base64')" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, 'base64')" - Dynamic Base64 Decoding in lib/Utils/decode-wa-message.js: "Buffer.from(secret, 'base64')" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, 'base64')" - String Array Obfuscation in lib/Utils/message-composer.js: "[ 'import', 'export', 'from', 'default', 'as', 'const', 'let', 'var', 'function'..." - String Array Obfuscation in lib/Utils/messages.js: "[ 'break', 'case', 'catch', 'continue', 'debugger', 'default', 'delete', 'do', '..." - String Array Obfuscation in lib/WABinary/constants.js: "[ '1724', 'profile_picture', '1071', '1314', '1605', '407', '990', '1710', '746'..." - Strings Extracted from Deobfuscated Code in lib/Signal/core/session_record.js (+3 more) ADDITIONAL FINDINGS - Platform Detection with Data Collection in lib/Socket/message-builder.js: "JSON.stringify({ sections })).toS" - Dynamic Code Execution in lib/Utils/message-composer.js: "exec(line)" - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES lib/Utils/generics.js (+ lib/Utils/messages-media.js, lib/Utils/chat-utils.js)