GCVE-110-OSM-2026-4065

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. [osmalyze-auto] Entrypoint: setup.mjs (install-hook: node setup.mjs) Exfil: https://fulcio.sigstore.dev (custom-c2, recovery: plaintext in router_init.js) Payload: router_init.js Key findings: - Environment Variable Exfiltration in router_init.js: "process.env,_0x29abe1=await _0x1186c8[_0x14fc47(0x2a2e)](fetch" - Download Execute Delete Pattern in setup.mjs: "writeFileSync(dt, fd); } function xb(zp, en, od) { if (hc("unzip", ["-v"])) {..." - Dynamic Code Execution in dist/index.js: "exec(val)" - Shell Command Execution in dist/index.js: "require("child_process")" - Shell Command Variable Setup in dist/index.js: "Windows ? pathExtExe.split(colon) : [""]; if (isWindows) { if (cmd.ind..." IOCs: - urls: https://fulcio.sigstore.dev - domains: opts.no, seed1.getsession.org, seed3.getsession.org, fulcio.sigstore.dev, kubernetes.io - sha256Hashes: 92de29dfb8c4227e7768c9c4c54016031a96f03d6e455fa65c5fd945b549d397, f33e5332b24c3773e930e212cbb8b6867c8ba3ec4492064ea78e55a524d57450, 45b7ab580deca34ae9729e97c13cfd999df04416a79116c3bfb483804f85ded4, 26f2f787e82c4222710f3b676b4d83eb5ad0a72fa7b746f03449e7a026ce5073, 9a68c0c07ae2fa71b44384a839b7b8d81662a236d4b9ac30916718f7510b1b2d (+45 more) - payloadFileHash: 29c729852fce5a53e30a1541d9fec79c915b2e13f1eda94a5978cf0aae0d88d9