GCVE-110-OSM-2026-14682

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY index.js (main: index.js) DESTINATION - 87 exfil (custom-c2) - 2 c2 (domains) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in dist/index.html: "btoa(" - Dynamic C2 Endpoint Construction in dist/index.html: "function w(e, t) { for (var n in t) e[n] = t[n]; return e } function E(e) { e &&..." - Network Request in dist/index.html: "Requests.get(" OBFUSCATION - Decoded Base64 Content in dist/arctic.html - Decoded Base64 Content in index.svg - Dynamic Base64 Decoding in dist/index.html: "atob(e)" - Base64 Encoded Payload in dist/arctic.html: ""aHR0cHM6Ly9jZG4uanNkZWxpdnIubmV0L2doL3NlYWxpZWUxMS9hcmN0aWNAbWFpbi9pbmRleC5odG1..." - String Array Obfuscation in dist/index.html: "[">>>=", "===", "!==", "**=", "&&=", "||=", "??=", ">>>", "<<=", ">>=", "=>", "=..." - recovered 2 urls, 6 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Platform Detection with Data Collection in dist/ai.js: "JSON.stringify({type:"mediaDone",mediaId,prompt:prompt||"Describe this image.",w..." - Dynamic Code Execution in dist/index.html: "exec(e)" - Suspicious TLD Domain in dist/index.html: "https://toustream.xyz" - Publisher Shows Burner-Account Pattern PAYLOAD FILES dist/index.html (+ dist/arctic.html, index.svg)