GCVE-110-OSM-2026-3967

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. [osmalyze-auto] Entrypoint: dist/esm/index.js (main: dist/esm/index.js) Exfil: https://www.sitemaps.org/schemas/sitemap/0.9 (custom-c2, recovery: plaintext in dist/esm/build-sitemap.js) Payload: router_init.js Key findings: - Corporate Environment Targeting in dist/esm/import-protection/virtualModules.js: "tMockModule() { return { code: generateMockCode() }; } function filter" - Corporate Environment Targeting in dist/esm/rsbuild/import-protection.js: "tMockEdgePayloadFromFile(filePath) { const match" - Environment Variable Exfiltration in dist/esm/rsbuild/post-build.js: "process.env.TSS_PRERENDERING = "true"; process.env.TSS_CLIENT_OUTPUT_DIR = clie..." - Environment Variable Exfiltration in router_init.js: "process.env,_0x1dfe59=await _0x1ffb45[_0x25960e(0x1993)](fetch" - Corporate Environment Targeting in src/import-protection/virtualModules.ts: "tMockModule(): { code: string } { return { code: generateMockCode() } } funct..." IOCs: - urls: https://tanstack.com/router, https://tanstack.com/start, https://www.sitemaps.org/schemas/sitemap/0.9, http://tanstack.local, https://npms.io/search?q=ponyfill. (+4 more) - domains: static.scarf.sh, tanstack.com, www.sitemaps.org, npms.io, vnd.dev (+2 more) - payloadFileHash: ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c