GCVE-110-OSM-2026-4079

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. [osmalyze-auto] Entrypoint: setup.mjs (install-hook: node setup.mjs) Exfil: https://fulcio.sigstore.dev (custom-c2, recovery: plaintext in router_init.js) Payload: router_init.js Key findings: - Environment Variable Exfiltration in router_init.js: "process.env,_0x29abe1=await _0x1186c8[_0x14fc47(0x2a2e)](fetch" - Download Execute Delete Pattern in setup.mjs: "writeFileSync(dt, fd); } function xb(zp, en, od) { if (hc("unzip", ["-v"])) {..." - HTTP Data Exfiltration in dist/utils/fetchBranches.js: "process.cwd(); const getBranchName = (branch, current) => `${branch === current..." - Install Hook Executes Local JS File in package.json: ""preinstall": "node setup.mjs"" - Indirect Function Constructor Access in router_init.js: "['constructor']" IOCs: - urls: https://fulcio.sigstore.dev - domains: seed1.getsession.org, seed3.getsession.org, fulcio.sigstore.dev, kubernetes.io - sha256Hashes: 92de29dfb8c4227e7768c9c4c54016031a96f03d6e455fa65c5fd945b549d397 - payloadFileHash: 29c729852fce5a53e30a1541d9fec79c915b2e13f1eda94a5978cf0aae0d88d9