GCVE-110-OSM-2026-5699

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. Entrypoint: lib/_compiler.js (install-hook: node lib/_compiler.js) Exfil: https://oapi.dingtalk.com/robot/send?access_token=4e5cb67fc5e23e66accddc1ac7463dd516439a43921595d4296faeb8419df393 (reconstructed, recovery: reconstructed in lib/_compiler.js) Payload: lib/_compiler.js Key findings: - Reconstructed Obfuscated URL in lib/_compiler.js: "https://oapi.dingtalk.com/robot/send?access_token=4e5cb67fc5e23e66accddc1ac7463d..." - Shell Command Execution in lib/_compiler.js: "require('child_process')" - Silent Process Execution in lib/_compiler.js: "stdio: 'ignore'" - Detached Child Process Payload in lib/_compiler.js: "spawn(process.execPath, ['-e', code], { stdio: 'ignore', detached: true" - Install Hook Executes Local JS File in package.json: ""postinstall": "node lib/_compiler.js"" IOCs: - urls: https://npm.netease.im/, https://oapi.dingtalk.com/robot/send?access_token=4e5cb67fc5e23e66accddc1ac7463dd516439a43921595d4296faeb8419df393 - domains: oapi.dingtalk.com, npm.netease.im - sha256Hashes: 4e5cb67fc5e23e66accddc1ac7463dd516439a43921595d4296faeb8419df393 - payloadFileHash: bd158e2c3e12c1c3661649a5215fafec97c606984dd005a76cc43df7c120d80d