GCVE-110-OSM-2026-4040

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. [osmalyze-auto] Entrypoint: dist/index.js (bin: dist/index.js) Exfil: https://westeurope-5.in.applicationinsights.azure.com/;LiveEndpoint=https://westeurope.livediagnostics.monitor.azure.com/;ApplicationId=35697ef1-8bd0-4f19-a27c-d87ccac66d2c (custom-c2, recovery: decoded in dist/index.js) Payload: dist/tool.js Secondary files: dist/index.js Key findings: - Corporate Environment Targeting in dist/index.js: "tMode) { if (DEPRECATED_BOOLEANS_SYNTAX.indexOf(string) !== -1 || DEPRECAT..." - Corporate Environment Targeting in dist/tool.js: "tMode) { if (DEPRECATED_BOOLEANS_SYNTAX.indexOf(string) !== -1 || DEPRECAT..." - Decoded Base64 Content in dist/index.js - Dynamic Code Execution in dist/index.js: "exec(val)" - Data Encoding for Exfiltration in dist/index.js: "encodeURIComponent(name).replace(/%2F/g" IOCs: - ipv4: 6.12.1.1 - urls: http://purl.org/dc/elements/1.1/, http://schemas.openxmlformats.org/package/2006/metadata/core-properties, http://schemas.openxmlformats.org/package/2006/content-types, http://schemas.openxmlformats.org/package/2006/relationships, http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties (+2 more) - domains: yaml.org, com.google.chrome.dev, LogLevel.Info, purl.org, t2.Network (+7 more) - payloadFileHash: 810007d7dff5dd8da80a5bb464991d35111e123b63868b12b73521b295fcd30a Decoded/deobfuscated IOCs: - urls: https://westeurope-5.in.applicationinsights.azure.com/;LiveEndpoint=https://westeurope.livediagnostics.monitor.azure.com/;ApplicationId=35697ef1-8bd0-4f19-a27c-d87ccac66d2c - domains: westeurope-5.in.applicationinsights.azure.com, westeurope.livediagnostics.monitor.azure.com