GCVE-110-OSM-2026-5079

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. Entrypoint: engine-requirements.js (install-hook: node ./engine-requirements.js) Exfil: update.me (custom-c2, recovery: plaintext in lib/Socket/socket.js) Payload: lib/Utils/messages-media.js Secondary files: lib/Utils/chat-utils.js Key findings: - Dynamic Base64 Decoding in lib/Signal/Group/group_cipher.js: "Buffer.from(iv, 'base64')" - Dynamic Base64 Decoding in lib/Signal/Group/sender-key-state.js: "Buffer.from(chainKey, 'base64')" - Platform Detection with Data Collection in lib/Socket/messages-recv.js: "JSON.stringify({ ...child, content: Buffer.isBuffer(child.content) ? child.conte..." - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" IOCs: - ipv4: 2.25.23.24 - domains: sock.ws, wa.me, creds.me, update.me, whatsapp.net (+25 more) - emails: 16505361212@c.us, server@c.us, 0@c.us - bitcoinAddresses: 123456789ABCDEFGHJKLMNPQRSTVWXYZ - payloadFileHash: 7295a6b249f8dd97f121653d4296ac9ff4cb7bdc0c62fd3d70c5edef524ceb04