GCVE-110-OSM-2026-2595

Reverse shell that polls mac.soqui.dev/obtener every 3 seconds for arbitrary shell commands via GET, executes them with child_process.exec(), and exfiltrates stdout/stderr to /output via POST. Fires at require-time with no install hook. Publisher email (soquicontacto@gmail.com) shares the 'soqui' identifier with the C2 domain, confirming same actor. **Trigger** (require-time): `index.js` executes immediately on `require()` — no install hook needed. **C2 protocol**: `GET https://mac.soqui.dev/obtener` polls every 3000ms. If response JSON contains `cmd` field, the value is passed directly to `child_process.exec(json.cmd)`. Command output (stdout or stderr) is sent back via `POST https://mac.soqui.dev/output` with JSON body `{ output: <result> }`. **Persistence**: `process.on('uncaughtException', () => {})` silently swallows all errors to keep the beacon loop alive. **Language**: Spanish-language comments throughout ('Configuración de tu C2', 'Error de red, el C2 podría estar caído'). **C2 status**: Domain resolves via Cloudflare (104.21.60.39), valid TLS cert (issued 2026-04-09), but backend returns 502 Bad Gateway — infrastructure intact but origin unreachable.