GCVE-110-OSM-2026-4009

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, obfuscated code. [osmalyze-auto] Entrypoint: dist/uipathRobot.js (main: dist/uipathRobot.js) Exfil: https://breeze.aimon.applicationinsights.io (custom-c2, recovery: plaintext in dist/js/UiPathRobot.js) Payload: dist/js/UiPathRobot.js Key findings: - Browser Data Theft in dist/js/UiPathRobot.js: "Chrome/5")&&!$t(e,"Chrome/6")&&(!$t(e,"UnrealEngine")||$t(e,"Chrome"))&&!$t(e,"U..." - Data Encoding for Exfiltration in dist/js/UiPathRobot.js: "encodeURIComponent(e)+"&Origin="+encodeURIComponent(window.location.origin)},e.o..." - Dynamic C2 Endpoint Construction in dist/js/UiPathRobot.js: "function R(e,t){return e&&w[s].hasOwnProperty.call(e,t)}function O(e){return e&&..." - Obfuscation: function to array replacements in dist/js/UiPathRobot.js - Data Encoding for Exfiltration in dist/utils/protocolUtil.js: "encodeURIComponent(consentCode) + "&Origin=" + encodeURIComponent(window.locatio..." IOCs: - urls: http://godban.github.io/browsers-support-badges/, https://docs.uipath.com/robot/, https://docs.uipath.com/robot/docs/sdk-specifications, https://robotjs.uipath.com/samples, https://breeze.aimon.applicationinsights.io (+2 more) - domains: godban.github.io, docs.uipath.com, robotjs.uipath.com, breeze.aimon.applicationinsights.io, az416426.vo.msecnd.net - bitcoinAddresses: 3noBcBLnZjnV9fYceK6Q7vkPHhiEcbHP, 3Zz4ncrHneM6PHT8izF5kxBvQy - payloadFileHash: 0f31ed3e8feca59ee019eb67c55574e8e471b2e5947549f80b568552c192e768