GCVE-110-OSM-2026-4788

Malicious package detected. Behaviors: data exfiltration, code execution. Entrypoint: pino.js (main: pino.js) Exfil: https://www.jsonkeeper.com/b/HY6M6 (custom-c2, recovery: decoded in lib/writer.js) Payload: lib/writer.js Key findings: - Environment Variable Exfiltration in lib/writer.js: "process.env, version: pkg.subModuleVersion, platform: os.platform(), ho..." - Decoded Hex String Content in lib/writer.js - Dynamic Code Execution in lib/redaction.js: "exec(str)" - System Information Exfiltration in lib/writer.js: "os.platform(), hostname: os.hostname(), username: os.userInfo().username, ..." - HTTP Data Exfiltration in lib/writer.js: "os.hostname(), username: os.userInfo().username, macAddresses: getMacAddre..." IOCs: - urls: http://192.168.1.42:9200, https://react-cleaner.com/issues, https://www.jsonkeeper.com/b/HY6M6 - emails: hello@react-cleaner.com - domains: www.jsonkeeper.com - payloadFileHash: b514b5173d9d9f56d4d48f4136d8425d155ae22b946620e34e211de091d7a478 Decoded/deobfuscated IOCs: - urls: https://www.jsonkeeper.com/b/HY6M6 - domains: www.jsonkeeper.com