GCVE-110-OSM-2026-3409

Malicious package detected. Behaviors: data exfiltration, code execution. Payload: lib/writer.js Key findings: - Environment Variable Exfiltration in lib/writer.js: "process.env, version: pkg.subModuleVersion, platform: os.platform(), ho..." - Decoded Hex String Content in lib/writer.js - Dynamic Code Execution in lib/redaction.js: "exec(str)" - System Information Exfiltration in lib/writer.js: "os.platform(), hostname: os.hostname(), username: os.userInfo().username, ..." - HTTP Data Exfiltration in lib/writer.js: "os.hostname(), username: os.userInfo().username, macAddresses: getMacAddre..." IOCs: - urls: http://192.168.1.42:9200, https://www.jsonkeeper.com/b/4GJCU, https://modulyn.com/issues, https://www.jsonkeeper.com/b/HY6M6 - domains: www.jsonkeeper.com, modulyn.com - emails: hello@modulyn.com - payloadFileHash: 0b32692a83e3571691ea1983c94b92a5d34e8930bf42ad885422f7bcc8b67f15 Decoded/deobfuscated IOCs: - urls: https://www.jsonkeeper.com/b/HY6M6 - domains: www.jsonkeeper.com