GCVE-110-OSM-2026-4018

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. [osmalyze-auto] Entrypoint: dist/index.js (main: ./dist/index.js) Exfil: https://cloud.uipath.com (custom-c2, recovery: plaintext in dist/index.js) Payload: dist/index.js Key findings: - Environment Variable Exfiltration in dist/index.js: "process.env?.DEBUG) { logger.info(`DEBUG GET: ${url}`); } const response..." - Corporate Environment Targeting in dist/index.js: "tMode)(it, `property ${prop} matches pattern ${pat} (use allowMatch" - Dynamic Code Execution in dist/index.js: "exec(val)" - Shell Command Execution in dist/index.js: "require("child_process")" - Data Encoding for Exfiltration in dist/index.js: "Buffer.from(s2.auth).toString("base64")" IOCs: - ipv4: 1.22.0.0 - urls: https://cloud.uipath.com, https://govcloud.uipath.us, https://docs.uipath.com/{0, https://alpha.uipath.com/entity/Azure/connections_, https://alpha.uipath.com/uipattycyrhx/abizon_1/orchestrator_ - domains: com.google.chrome.dev, cloud.uipath.com, i2.Network, t2.Network, this.it (+7 more) - sha256Hashes: 3909c231653cfe246b1d9e77555e0a9735f4383136d6abe316b38cfa4257fe0b, d0d1d19ba5cd398969830c85c85cd6709a01227bcaf43b3011e0ca70c833ec11, 2c7eddc9b759b4a59582253a0c532550f4442f63e3c8bfdfbe96c24b272fc27d, b7b5e18a0859399468d46248d2af16839492259d9c1b296096fe4cfca629a6ee, 0dad78c9d04c245b126d8edb4c451aa8a0d395d34731cf5702441f6284c70ccc (+45 more) - payloadFileHash: 8f2982253b4eae3889ff2ad0ee2aaf706b39a7c302109a3d7352da8d28aab584