GCVE-110-OSM-2026-5667

Malicious package detected. Behaviors: data exfiltration, install-time execution. Entrypoint: index.js (install-hook: node index.js) Exfil: https://f1ackavab3.execute-api.eu-west-2.amazonaws.com/ (reconstructed, recovery: reconstructed in index.js) Payload: index.js Key findings: - Reconstructed Obfuscated URL in index.js: "https://f1ackavab3.execute-api.eu-west-2.amazonaws.com/" - Platform Detection with Data Collection in index.js: "JSON.stringify({h:require('os').hos" - Install Hook Executes Local JS File in package.json: ""postinstall": "node index.js"" - Brand New Package IOCs: - urls: https://f1ackavab3.execute-api.eu-west-2.amazonaws.com/ - domains: f1ackavab3.execute-api.eu-west-2.amazonaws.com - payloadFileHash: 9de09d66735ef7b0e390f9e2511369d7070b2f26c55b6a56b08d5d77a741382a