GCVE-110-OSM-2026-4470

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. [osmalyze-auto] Entrypoint: engine-requirements.js (install-hook: node ./engine-requirements.js) Exfil: api.telegram.org/bot8949658562:AAGR7SZy (telegram-bot, recovery: decoded in lib/Socket/socket.js) Payload: lib/Socket/socket.js Key findings: - Base64 Decoded Eval in lib/Socket/socket.js: "eval(Buffer.from(" - Base64 Decoded Eval in lib/index.js: "eval(Buffer.from(" - Decoded Base64 Content in lib/Socket/socket.js - Dynamic Base64 Decoding in lib/Signal/Group/group_cipher.js: "Buffer.from(iv, 'base64')" - Dynamic Base64 Decoding in lib/Signal/Group/sender-key-state.js: "Buffer.from(chainKey, 'base64')" IOCs: - ipv4: 2.25.23.24 - domains: sock.ws, creds.me, update.me, whatsapp.net, mmg.whatsapp.net (+26 more) - emails: 16505361212@c.us, server@c.us, 0@c.us - bitcoinAddresses: 123456789ABCDEFGHJKLMNPQRSTVWXYZ - urls: https://api.telegram.org/bot8949658562:AAGR7SZy-ffXkzyYNCAeJRP02dnLGATFwgk/sendMessage - telegramBots: api.telegram.org/bot8949658562:AAGR7SZy - payloadFileHash: 8508accb619ce351810f158998335e43116f90ffe8bd5721d6acb2a63c178bff Decoded/deobfuscated IOCs: - urls: https://api.telegram.org/bot8949658562:AAGR7SZy-ffXkzyYNCAeJRP02dnLGATFwgk/sendMessage - domains: api.telegram.org - telegramBots: api.telegram.org/bot8949658562:AAGR7SZy