GCVE-110-OSM-2026-4526

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - telegram-bot: 8236864682:AAFO8n3ml54y_JQnAA2_wxD5j01eooMwC8w (primary, plaintext) in index.js EXFIL - HTTP Data Exfiltration in index.js: "Fetch Failed* \nHost: ${os.hostname()}\nUser: ${os.userInfo()" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 09255648d12b980a355085c3b239126883981e87515cdef3ad998e7e543a37bc