GCVE-110-OSM-2026-1550

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. Payload: dist/generators/outputs/vuln.js Secondary files: src/generators/outputs/vuln.ts, dist/templates/scenarios/advanced.js Key findings: - Sensitive File Access in dist/generators/outputs/cloud.js: "".aws/credentials"" - Sensitive File Access in dist/generators/outputs/exploit.js: ""/etc/passwd"" - Sensitive File Access in dist/generators/outputs/vuln.js: "".ssh/id_rsa"" - OAST/Interactsh Exfiltration in dist/schemas/tools/exploit.js: "interact.sh" - OAST/Interactsh Exfiltration in dist/schemas/tools/recon.js: "interact.sh" IOCs: - ipv4: 93.184.216.34, 93.184.216.35, 93.184.216.36, 93.184.216.40, 5.6.7.8 - ipv6: 8::, 1000:1000::, 7:: - urls: http://c2pa-ocsp.pki.goog/04+
0�(http://pki.goog/c2pa/media-1p-ica-g3.crt0U, http://pki.goog/c2pa/root-g3.crt0&+
0
�http://c2pa-ocsp.pki.goog/0U#0��\؉SC�ZՁ��**-�0U�{ὴ, http://c2pa-ocsp.pki.goog/04+
0�(http://pki.goog/c2pa/core-tsa-ica-g3.crt0U, http://pki.goog/c2pa/root-g3.crt0&+
0
�http://c2pa-ocsp.pki.goog/0U#0��\؉SC�ZՁ��**-�0U�U��`t;�j�De�a����0, http://pki.goog/c2pa/media-1p-ica-g3.crt0 (+45 more) - domains: acme-corp.com, cv.iptc.org, ns.adobe.com, purl.org, 9.aU (+45 more) - emails: test@corp.com, ceo@corp.com, callback%23@evil.com, admin@corp.com, devops@corp.com (+2 more) - awsAccessKeys: AKIAIOSFODNN7EXAMPLE, AIDAIOSFODNN7EXAMPLE - githubTokens: ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx - payloadFileHash: 7962f53fc1982aae800f7eaf890d82875814e06ace34d22e5d0f6efcda3793d0