GCVE-110-OSM-2026-5221

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. Entrypoint: lib/main-cli.js (bin: lib/main-cli.js) Exfil: https://chromium.googlesource.com/chromium/src.git/+/main/tools/bisect-builds.py (custom-c2, recovery: plaintext in lib/CLI.js) Payload: lib/CLI.js Secondary files: src/CLI.ts, lib/install.js Key findings: - Download Execute Delete Pattern in lib/Cache.js: "executablePaths?.[key]) { delete metadata.executablePaths[key]; ..." - Download Execute Delete Pattern in lib/install.js: "spawnSync } from 'node:child_process'; import { existsSync, readFileSync } from ..." - Download Execute Delete Pattern in src/Cache.ts: "executablePaths?.[key]) { delete metadata.executablePaths[key]; this..." - Download Execute Delete Pattern in src/install.ts: "spawnSync} from 'node:child_process'; import {existsSync, readFileSync} from 'no..." - System Information Exfiltration in lib/CLI.js: "os.homedir(), 'bisect-builds.py'); if (!fs.existsSync(bisectScriptPa..." IOCs: - urls: https://chromium.googlesource.com/chromium/src.git/+/main/tools/bisect-builds.py, https://chromium.googlesource.com/chromium/src.git/+/main/tools/bisect-builds.py?format=TEXT, https://googlechromelabs.github.io/chrome-for-testing, https://source.chromium.org/chromium/chromium/src/+/main:chrome/installer/mini_installer/README.md, https://source.chromium.org/chromium/chromium/src/+/main:chrome/common/chrome_paths_win.cc;l=42;drc=4c86c7940a47c36b8bf52c134483ef2da86caa62 (+4 more) - domains: chromium.googlesource.com, googlechromelabs.github.io, source.chromium.org, pptr.dev - payloadFileHash: 2b4ce560effbfed5af7f3945e171dc4c17c36172721f32a14e7b9d333e2c7db7