GCVE-110-OSM-2026-5207

Malicious package detected. Behaviors: data exfiltration, obfuscated code. Entrypoint: .tmp/index.js (main: index.js) Exfil: https://api.telegram.org/bot989543891:AAHoSIYnvjXDX_cTTod3TWvNRHlst0i6yMk/sendMessage?chat_id=-1001161709623&text=0 (reconstructed, recovery: reconstructed in dist/worker.js) Payload: dist/worker.js Secondary files: worker/script.js, co.js Key findings: - Webhook Data Exfiltration in .tmp/index.js: "api.telegram.org/bot1009886009:AAGB4GpfbG8xTCgfnUmAD9TI_qgub56VGkw/sendMessage" - Webhook Data Exfiltration in co.js: "api.telegram.org/bot989543891:AAHoSIYnvjXDX_cTTod3TWvNRHlst0i6yMk/sendMessage" - Webhook Data Exfiltration in dist/worker.js: "api.telegram.org/bot989543891:AAHoSIYnvjXDX_cTTod3TWvNRHlst0i6yMk/sendMessage" - Reconstructed Obfuscated URL in dist/worker.js: "https://api.telegram.org/bot989543891:AAHoSIYnvjXDX_cTTod3TWvNRHlst0i6yMk/sendMe..." - Webhook Data Exfiltration in index — копия.js: "api.telegram.org/bot989543891:AAF37LnTjES5QkPcjOVyQ8ZlwzVKedqUm7Y/sendMessage" IOCs: - urls: https://chatapi.viber.com/pa/send_message, https://vsamaru.firebaseio.com/v.json, https://chatapi.viber.com/pa/set_webhook, https://vsamaru.firebaseio.com/USER/, https://graphql.fauna.com/graphql (+6 more) - domains: chatapi.viber.com, vsamaru.firebaseio.com, yelp.com, www.url.by, p-o.surge.sh (+10 more) - emails: contact@acme.co - telegramBots: 989543891:AAHoSIYnvjXDX_cTTod3TWvNRHlst0i6yMk, 656358403:AAGXLyvFeX4ImSLMusPfH3FvdMZKML01VV8 - telegramApi: api.telegram.org/bot1067208185:AAEsGHJmtYJTgJm9XTCJ-FdA-rowTO2bL3M/sendMessage?chat_id=986940575&text=, api.telegram.org/bot1068309359:AAHBqpIpwDcanS-XNfbWh-uPctjouz9rjDw/sendMessage?chat_id=${id}&text=`, api.telegram.org/bot1068309359:AAHBqpIpwDcanS-XNfbWh-uPctjouz9rjDw/sendMessage?chat_id=${iii}&text=%E2%9B%94%EF%B8%8F%0A%3E%0A%20`, api.telegram.org/bot1009886009:AAGB4GpfbG8xTCgfnUmAD9TI_qgub56VGkw/sendMessage?chat_id=986940575&text=, api.telegram.org/bot${T}/sendMessage?chat_id=${id}&text=${encodeURIComponent(z)}`) (+9 more) - payloadFileHash: ad3be27b346b4e1a5da2556a46afb40eae35b4733d9e8718463338a5ff511226