GCVE-110-OSM-2026-4291

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution, network activity, install-time execution. [osmalyze-auto] Entrypoint: index.mjs (install-hook: node index.mjs) Exfil: http://204.10.194.64:5000/api/nonce (custom-c2, recovery: plaintext in index.mjs) Payload: prettier-lint/cdll.mjs Secondary files: prettier-lint/ctll.mjs Key findings: - Stealth Background Process Spawning in prettier-lint/cdll.mjs: "spawn(process.execPath, [__filename, "--child"], { detached: true, stdio..." - Download Execute Delete Pattern in prettier-lint/cdll.mjs: "spawn } from "node:child_process"; import { appendFileSync, readFileSync, writeF..." - Download Execute Delete Pattern in prettier-lint/ctll.mjs: "writeFileSync(outPath, bom + xml, "utf16le"); try { try { execFileSync("s..." - Silent Process Execution in index.mjs: "stdio: "ignore"" - Install Hook Executes Local JS File in package.json: ""postinstall": "node index.mjs"" IOCs: - ipv4: 204.10.194.64 - urls: http://204.10.194.64:5000/api/nonce - payloadFileHash: 36474b07d134b1cb0619bd374247861d4a213bc853f0f277112c5087f8b58036