GCVE-110-OSM-2026-1516

Base64 encoded C2 in .env file that aligns with Neutralinojs compromise. This is a second C2 payload embedded in the repository in addition to malicious VSCode tasks.json. Malicious code executed on the user device if the user executes the code base. Attacker controlled C2 is base64 encoded as provided as input fetch and execute the payload from remote host.