GCVE-110-OSM-2026-4224

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code, install-time execution. [osmalyze-auto] Entrypoint: engine-requirements.js (install-hook: node ./engine-requirements.js) Exfil: 8282473663:AAFW7G31Mc9C5sLJs0p4PFVWcVaOGduGocs (telegram-bot, recovery: plaintext in lib/Defaults/index.js) Payload: lib/Socket/socket.js Secondary files: lib/Utils/generics.js, lib/Utils/messages-media.js Key findings: - Startup Persistence in lib/Socket/chats.js: ".profile" - Startup Persistence in lib/Socket/messages-send.js: ".profile" - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Whitespace-Padded Hidden Payload in lib/Socket/socket.js: "; const" - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" IOCs: - ipv4: 131.0.0.0 - urls: https://saweria.co/ipanzx, https://saweria.co/itsliaaa, https://saweria.co/ipanzxdev, https://wa.me/settings/linked_devices# - domains: saweria.co, sock.ws, wa.me, creds.me, update.me (+3 more) - emails: 16505361212@c.us, server@c.us, 0@c.us, 13135550002@c.us - telegramBots: 8282473663:AAFW7G31Mc9C5sLJs0p4PFVWcVaOGduGocs - telegramApi: api.telegram.org/bot${botToken}/sendMessage`, - bitcoinAddresses: 123456789ABCDEFGHJKLMNPQRSTVWXYZ - sha256Hashes: 142375574d0a587166aae71ebe516437c4a28b73e3695c6ce1f7f9545da8ee6b, 0903aa5f7f47de66789d5f4c86d3bd6e05e4bc3ff85e454a9f907d5ed7fef97c, f09d96b2f09d978df09d96baf09d978bf09d96bff09d96baf09d9785f09d9785 - payloadFileHash: ee286c83714ab40e57fbec5ddb1be91622b3eb91a1fe0ff61af60a95f5dc76f9