GCVE-110-OSM-2026-5201

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. Entrypoint: dist/scripts/preinstall.js (install-hook: node ./dist/scripts/preinstall.js) Exfil: https://cdn.sencha.com/reext/ext/ext-Ext.Panel.156.46 (reconstructed, recovery: reconstructed in dist/reext.es.js) Payload: dist/reext.es.js Secondary files: dist/reext.umd.js Key findings: - Reconstructed Obfuscated URL in dist/reext.es.js: "https://cdn.sencha.com/reext/ext/ext-Ext.Panel.156.46" - Reconstructed Obfuscated URL in dist/reext.umd.js: "https://cdn.sencha.com/reext/ext/ext-Ext.Panel.156.46" - Dynamic Code Execution in dist/reext.es.js: "exec(e)" - Data Encoding for Exfiltration in dist/reext.es.js: "Buffer.from(e).toString("base64")" - Dynamic Base64 Decoding in dist/reext.es.js: "atob(e)" IOCs: - ipv4: 7.0.0.156 - ipv6: C:: - urls: https://www.sencha.com/products/extjs/, https://create-react-app.dev/docs/getting-started/, https://store.sencha.com/, https://support.sencha.com/, https://docs.sencha.com/extjs/7.8.0/modern/Ext.Button.html (+8 more) - domains: www.sencha.com, create-react-app.dev, sencha.com, store.sencha.com, support.sencha.com (+6 more) - emails: sales@sencha.com, lisa@simpsons.com, bart@simpsons.com, homer@simpsons.com, marge@simpsons.com (+5 more) - payloadFileHash: 3ce05b0169938d9732e3db415f6ea88b875777746555582e65d4e467eaaa12b3