GCVE-110-OSM-2026-2075

Malicious package detected. Behaviors: data exfiltration, obfuscated code. Payload: src/utils/_format.ts Key findings: - System Information Exfiltration in src/utils/_format.ts: "os.homedir(); if (_ch) await _sfr(_ch, _res, _md); } } c..." - Suspicious TLD Domain in esm/signing/mod.d.ts: "https://api.hyperliquid.xyz" - Suspicious TLD Domain in esm/signing/mod.js: "https://api.hyperliquid.xyz" - Suspicious TLD Domain in esm/transport/http/mod.d.ts: "https://api.hyperliquid.xyz" - Suspicious TLD Domain in esm/transport/http/mod.js: "https://api.hyperliquid.xyz" IOCs: - urls: https://deno.com, https://docs.deno.com/runtime/getting_started/setup_your_environment/, https://jsr.io/@std, https://valibot.dev/, https://jsr.io/badges/@nktkas/hyperliquid (+17 more) - domains: deno.com, docs.deno.com, jsr.io, valibot.dev, bundlephobia.com (+17 more) - emails: github.turk9@passmail.net, root@srv141316.hosttoname.com - ethereumAddresses: 0x0000000000000000000000000000000000000001, 0x0000000000000000000000000000000000000000 - payloadFileHash: b87a08a7669055d284dd70ca7fed722d5d1886af98fc070be55ccf4c43930a1e