GCVE-110-OSM-2026-2578

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. Payload: index.js Key findings: - Shell Command Execution in index.js: "require("child_process")" - Data Encoding for Exfiltration in index.js: "encodeURIComponent(message)}&parse_mode=Markdown" - Suspicious URL Pattern in Template Literal in index.js: "https://api.telegram.org/bot7801695443:AAFS7MKLcAnAAkEClSTpq7QTrK3bCYrgYOA/sendM..." - Install Hook Executes Local JS File in package.json: ""preinstall": "node index.js"" IOCs: - telegramBots: 7801695443:AAFS7MKLcAnAAkEClSTpq7QTrK3bCYrgYOA - telegramApi: api.telegram.org/bot${token}/sendMessage?chat_id=${chatId}&text=${encodeURIComponent(message)}&parse_mode=Markdown`; - payloadFileHash: 2228b586396d7492910369772a16d614c4632866dc7c2e79e222e621b6a66197