GCVE-110-OSM-2026-4223

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. [osmalyze-auto] Entrypoint: engine-requirements.js (install-hook: node ./engine-requirements.js) Exfil: https://mmg.whatsapp.net/ (custom-c2, recovery: plaintext in lib/Utils/messages-media.js) Payload: lib/Socket/newsletter.js Secondary files: lib/Utils/chat-utils.js, lib/Utils/messages-media.js Key findings: - Decoded Base64 Content in lib/Socket/newsletter.js - Dynamic Base64 Decoding in lib/Signal/Group/group_cipher.js: "Buffer.from(iv, 'base64')" - Dynamic Base64 Decoding in lib/Signal/Group/sender-key-state.js: "Buffer.from(chainKey, 'base64')" - Startup Persistence in lib/Socket/messages-send.js: ".profile" - Startup Persistence in lib/Socket/messages-send.js.backup: ".profile" IOCs: - urls: https://mmg.whatsapp.net/, https://files.giftedtech.co.ke/file/chJids.json - domains: sock.ws, wa.me, creds.me, update.me, whatsapp.net (+3 more) - emails: 16505361212@c.us, server@c.us, 0@c.us, 13135550002@c.us - bitcoinAddresses: 123456789ABCDEFGHJKLMNPQRSTVWXYZ - payloadFileHash: 1508b7661ece1baa15c8b20280de4ae8b49ccaa4a5fd42d341bd700e97856cf8 Decoded/deobfuscated IOCs: - urls: https://files.giftedtech.co.ke/file/chJids.json - domains: files.giftedtech.co