GCVE-110-OSM-2026-4256

This github repo hides a malicious JavasScript stager that downloads and additional payload. If you clone this repo and commit any code to it, that will run the pre-commit git hook in the .husky/pre-commit file, which in turn runs "node .husky/push-to-checkout.sample. In that .husky/push-to-checkout.sample file is a lightly obfuscated JavaScript stager that pulls a second stage from https://www.ipregionchecker.net/api/ip-check-encrypted/3aeb34a33. That stage is a more heavily obfuscated 3.4MB file that is named main.js that we speculate is Beavertail