GCVE-110-OSM-2026-3407

Malicious package detected. Behaviors: data exfiltration, obfuscated code, install-time execution. Payload: index.js Key findings: - Decoded Base64 Content in index.js - Decoded Base64 Content in [deobfuscated] index.js - System Information Exfiltration in index.js: "os.homedir(), inline: false } ], footer: { text:..." - Dynamic Base64 Decoding in index.js: "Buffer.from(_0x412, 'base64')" - Install Hook Executes Local JS File in package.json: ""postinstall": "node index.js"" IOCs: - urls: https://discord.com/api/webhooks/1499097922124386554/hvfWM3tCcewiFTlvjT3R77uPyPGMhfUCvLPxx-BUzl_No1_j076GZ028pX0_3N-KkuY7 - domains: discord.com - discordWebhooks: discord.com/api/webhooks/1499097922124386554/hvfWM3tCcewiFTlvjT3R77uPyPGMhfUCvLPxx-BUzl_No1_j076GZ028pX0_3N-KkuY7 - payloadFileHash: 1ae551c90dc74b1def5868b8c0d097a9806a6dcdcb6ad1fbd51beeecf41a7831 Decoded/deobfuscated IOCs: - urls: https://discord.com/api/webhooks/1499097922124386554/hvfWM3tCcewiFTlvjT3R77uPyPGMhfUCvLPxx-BUzl_No1_j076GZ028pX0_3N-KkuY7 - domains: discord.com - discordWebhooks: discord.com/api/webhooks/1499097922124386554/hvfWM3tCcewiFTlvjT3R77uPyPGMhfUCvLPxx-BUzl_No1_j076GZ028pX0_3N-KkuY7