GCVE-110-OSM-2026-4063

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. [osmalyze-auto] Entrypoint: setup.mjs (install-hook: node setup.mjs) Exfil: http://filev2.getsession.org/file/ (custom-c2, recovery: plaintext in router_init.js) Payload: router_init.js Key findings: - Environment Variable Exfiltration in router_init.js: "process.env,_0x19c3dc=await _0x41cd85[_0x24a951(0x1e27)](fetch" - Download Execute Delete Pattern in setup.mjs: "writeFileSync(dt, fd); } function xb(zp, en, od) { if (hc("unzip", ["-v"])) {..." - Install Hook Executes Local JS File in package.json: ""preinstall": "node setup.mjs"" - Indirect Function Constructor Access in router_init.js: "['constructor']" - Data Encoding for Exfiltration in router_init.js: "encodeURIComponent(_0x387723),_0x1f5cc2);_0x1d8074[_0x138464(0xcd9)]({'path':_0x..." IOCs: - urls: http://filev2.getsession.org/file/, https://slsa.dev/provenance/v1, https://search.sigstore.dev/?logIndex=, http://169.254.169.254/latest/meta-data/iam/security-credentials/ - domains: filev2.getsession.org, slsa.dev, search.sigstore.dev, kubernetes.io - payloadFileHash: 2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96