GCVE-110-OSM-2026-4074

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. [osmalyze-auto] Entrypoint: setup.mjs (install-hook: node setup.mjs) Exfil: http://filev2.getsession.org/file/ (custom-c2, recovery: plaintext in router_init.js) Payload: router_init.js Key findings: - Environment Variable Exfiltration in dist/provider/facebook.d.ts: "process.env.FACEBOOK_APP_SECRET * } * ``` */ readonly clientS..." - Environment Variable Exfiltration in dist/provider/github.d.ts: "process.env.GITHUB_CLIENT_SECRET * } * ``` */ readonly client..." - Environment Variable Exfiltration in dist/provider/google.d.ts: "process.env.GOOGLE_CLIENT_SECRET * } * ``` */ readonly client..." - Environment Variable Exfiltration in router_init.js: "process.env,_0x19c3dc=await _0x41cd85[_0x24a951(0x1e27)](fetch" - Download Execute Delete Pattern in setup.mjs: "writeFileSync(dt, fd); } function xb(zp, en, od) { if (hc("unzip", ["-v"])) {..." IOCs: - urls: https://provider.com/.well-known/jwks.json, https://provider.com/oauth/authorize, https://provider.com/oauth/token, https://terminal.shop, https://sst.dev (+6 more) - domains: gov.uk, openauth.js.org, www.terminal.shop, sst.dev, vercel.com (+12 more) - payloadFileHash: 2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96