GCVE-110-OSM-2026-14755

Malicious package detected. Behaviors: data exfiltration, obfuscated code. ENTRY dist/index.js (default-index: index.js) EXFIL - System Information Collection in telemetry-info.mjs: "os.userInfo()" OBFUSCATION - Dynamic Base64 Decoding in dist/runtime-matrix.mjs: "atob(_0x8d53a2e3f[" - Dynamic Base64 Decoding in telemetry-info.mjs: "atob(_0xc7c9261e2[" - Obfuscation (osm-deobfuscator): NiceGUI Multi-layer Obfuscation in dist/runtime-matrix.mjs - String Array Obfuscation in dist/data/registry-3.js: "["entry-facet-0", "lens-label-1", "profile-row-2", "entry-marker-3", "list-profi..." - String Array Obfuscation in dist/data/registry-6.js: "["signal-marker-0", "bias-score-1", "grid-entry-2", "entry-map-3", "key-vector-4..." - Obfuscation: array function replacements in dist/runtime-matrix.mjs - Obfuscation: array function replacements in telemetry-info.mjs - Obfuscation (osm-deobfuscator): unknown in telemetry-info.mjs (+5 more) ADDITIONAL FINDINGS - Silent Process Execution in telemetry-info.mjs: "windowsHide: true" - Detached Child Process Payload in telemetry-info.mjs: "spawn(P.execPath, [stashPath], {detached: true" - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES telemetry-info.mjs