GCVE-110-OSM-2026-3068

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code, install-time execution. Payload: annotator.html Secondary files: dist/index.js Key findings: - Corporate Environment Targeting in annotator.html: "tMode&&(JNe.indexOf(e)!==-1||eOe.test" - Dynamic Code Execution in annotator.html: "exec(t)" - XOR-Encoded String Arrays in annotator.html: "var r=[0,0,1,0,1,1,0,0,1,1,0,1]" - Data Encoding for Exfiltration in annotator.html: "btoa(" - Dynamic C2 Endpoint Construction in annotator.html: "function wx(t,e){return t==null||e==null?NaN:t<e?-1:t>e?1:t>=e?0:NaN}function S2..." IOCs: - ipv4: 138.112.25.25 - ipv6: fe80::, fc00:: - urls: https://react.dev/errors/, https://konradmichalik.github.io/md-annotator/install.sh, http://engelschall.com, https://jquery.org/license/, https://tldrlegal.com/license/mit-license (+19 more) - domains: react.dev, g0.re, f.group, n.group, yaml.org (+18 more) - payloadFileHash: 48e0ab3187ddcb19f9e0340736bc588a2d4bb25c33f732d62545e4a6bed359ca