GCVE-110-OSM-2026-3422

Malicious package detected. Behaviors: data exfiltration, obfuscated code, install-time execution. Payload: index.js Key findings: - Decoded Base64 Content in index.js - Decoded Base64 Content in [deobfuscated] index.js - System Information Exfiltration in index.js: "os.homedir(), inline: false } ], footer: { text:..." - Dynamic Base64 Decoding in index.js: "Buffer.from(_0x412, 'base64')" - Install Hook Executes Local JS File in package.json: ""postinstall": "node index.js"" IOCs: - urls: https://discord.com/api/webhooks/1499097922124386554/hvfWM3tCcewiFTlvjT3R77uPyPGMhfUCvLPxx-BUzl_No1_j076GZ028pX0_3N-KkuY7 - domains: discord.com - discordWebhooks: discord.com/api/webhooks/1499097922124386554/hvfWM3tCcewiFTlvjT3R77uPyPGMhfUCvLPxx-BUzl_No1_j076GZ028pX0_3N-KkuY7 - payloadFileHash: 1aef6727dac46af38fa9c7ca6e89b4f129d326e703ecbb4d165b9ce16c575d72 Decoded/deobfuscated IOCs: - urls: https://discord.com/api/webhooks/1499097922124386554/hvfWM3tCcewiFTlvjT3R77uPyPGMhfUCvLPxx-BUzl_No1_j076GZ028pX0_3N-KkuY7 - domains: discord.com - discordWebhooks: discord.com/api/webhooks/1499097922124386554/hvfWM3tCcewiFTlvjT3R77uPyPGMhfUCvLPxx-BUzl_No1_j076GZ028pX0_3N-KkuY7