GCVE-110-OSM-2026-4760

Installs a Windows PE backdoor (clob2.0.exe) at npm install time by fetching it silently from IPFS via violet-tricky-quelea-562.mypinata.cloud and three fallback gateways (CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa), registers HKCU Run key persistence via a hidden VBScript launcher, and beacons the victim's public IP to attacker C2 at 45.8.22.112:2026. Third package in the devcarron@gmail.com dropper campaign alongside clob.api and clobprice.api, sharing an identical IPFS CID and PE binary. **Trigger** (`postinstall`): executes `node clob.js` at install time. **Platform scope**: Windows only — macOS and Linux paths exit immediately (no payload URL configured in this version). **IP reconnaissance**: fetches `https://api.ipify.org` to retrieve the victim's public IP address. **Payload delivery**: constructs four IPFS gateway URLs for CID `bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa` across `violet-tricky-quelea-562.mypinata.cloud`, cloudflare-ipfs.com, gateway.pinata.cloud, and ipfs.io with redirect-following fallback; downloads `clob2.0.exe` (SHA256: 300a7dea05c2a588757010ad314fa55cb8ef3acebaa284f58a5cd0fd39bce478) to `%LOCALAPPDATA%\clob2.0.exe` via `https.get()` with browser User-Agent spoofing. **Persistence**: writes a VBScript launcher (`clob2.0-launcher.vbs`) using `WScript.Shell.Run` with window style 0 (fully hidden, no taskbar); registers it under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\clob` via `execSync('reg add ...')`. **Execution**: spawns `wscript.exe //nologo <vbs>` with `{detached:true, windowsHide:true}` and `.unref()` — backdoor survives npm install exit. **C2 beacon**: POSTs victim IP formatted as `<ip>:80` to `http://45.8.22.112:2026/api/urls` via `http.request()`. **PE binary**: ws2_32.dll imports (`connect`, `send`, `recv`) confirm network RAT capability; full second-stage behavior pending dynamic analysis.