GCVE-110-OSM-2026-4017

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. [osmalyze-auto] Entrypoint: dist/index.js (bin: ./dist/index.js) Exfil: http://www.omg.org/spec/BPMN/20100524/MODEL (custom-c2, recovery: plaintext in dist/packager-tool.js) Payload: dist/packager-tool.js Key findings: - Corporate Environment Targeting in dist/packager-tool.js: "tMode)(it, `property ${prop} matches pattern ${pat} (use allowMatch" - Dynamic Code Execution in dist/index.js: "exec(val)" - Dynamic Code Execution in dist/packager-tool.js: "exec(xml)" - Data Encoding for Exfiltration in dist/packager-tool.js: "Buffer.from(command, "utf16le").toString("base64")" - Dynamic Base64 Decoding in dist/packager-tool.js: "atob(base64)" IOCs: - ipv4: 6.12.1.1 - urls: http://www.omg.org/spec/BPMN/20100524/MODEL, http://www.omg.org/spec/BPMN/20100524/DI, http://www.omg.org/spec/DD/20100524/DC, http://www.omg.org/spec/DD/20100524/DI, http://bpmn.io/schema/bpmn/biocolor/1.0 (+45 more) - domains: www.omg.org, bpmn.io, this.it, cloud.uipath.com, core.action.transform.group (+9 more) - payloadFileHash: df3e24b162786f169ff3475c0c8a582f1913deace66e0f7d91c857bb6576eb3e