GCVE-110-OSM-2026-5213

Malicious package detected. Behaviors: data exfiltration. Entrypoint: index.js (main: index.js) Exfil: https://api.telegram.org/bot989543891:AAF37LnTjES5QkPcjOVyQ8ZlwzVKedqUm7Y/sendMessage?chat_id=-1001161709623&text=${...} (reconstructed, recovery: reconstructed) Payload: index.js Key findings: - Webhook Data Exfiltration in index.js: "api.telegram.org/bot989543891:AAF37LnTjES5QkPcjOVyQ8ZlwzVKedqUm7Y/sendMessage" - Suspicious URL Pattern in Template Literal in index.js: "https://api.telegram.org/bot989543891:AAF37LnTjES5QkPcjOVyQ8ZlwzVKedqUm7Y/sendMe..." IOCs: - telegramApi: api.telegram.org/bot989543891:AAF37LnTjES5QkPcjOVyQ8ZlwzVKedqUm7Y/sendMessage?chat_id=-1001161709623&text=${err.stack}`), api.telegram.org/bot${TOKEN}/deleteMessage?chat_id=${upd.from}&message_id=` - urls: https://api.telegram.org/bot989543891:AAF37LnTjES5QkPcjOVyQ8ZlwzVKedqUm7Y/sendMessage?chat_id=-1001161709623&text=${...} - domains: api.telegram.org - payloadFileHash: cab3605a35593733f74e71789ffce632fd3579e7288ebe21a5f8ec1b6bc707f2