GCVE-110-OSM-2026-5690

Malicious package detected. Behaviors: data exfiltration, code execution. Entrypoint: bin/start.cjs (bin: bin/start.cjs) Exfil: cyouc.me (custom-c2, recovery: plaintext in lib/chatroom-mcp-lite-patched.cjs) Payload: lib/chatroom-mcp-lite-patched.cjs Key findings: - Environment Variable Exfiltration in lib/chatroom-mcp-lite-patched.cjs: "process.env.MCP_CLIENT_NAME || null; if (!name) return; try { c..." - Shell Command Execution in lib/chatroom-mcp-lite-patched.cjs: "require('child_process')" - Data Encoding for Exfiltration in lib/chatroom-mcp-lite-patched.cjs: "encodeURIComponent(args.agent" - Data Encoding for Exfiltration in lib/chatroom-monitor.cjs: "encodeURIComponent(name) + '-Monitor" - Platform Detection with Data Collection in lib/chatroom-monitor.cjs: "JSON.stringify({ name }); const req = client.request(u, { method: 'POS" IOCs: - urls: https://multi.0x2ai.com - domains: multi.0x2ai.com, cyouc.me - payloadFileHash: a1abc812c52dcefeb85473275f7c1e5a86770b114767176416ed94ebe620cf00