GCVE-110-OSM-2026-5701

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. Entrypoint: prepinstall.js (install-hook: node ./prepinstall.js) Exfil: https://jsonkeeper.com/b/DWNFF (custom-c2, recovery: decoded in prepinstall.js) Payload: prepinstall.js Key findings: - Decoded Base64 Content in prepinstall.js - Install Hook Executes Local JS File in package.json: ""postinstall": "node ./prepinstall.js"" - Shell Command Execution in prepinstall.js: "require('child_process')" - Dynamic Base64 Decoding in prepinstall.js: "atob(HASH_KEY)" - Detached Child Process Payload in prepinstall.js: "spawn('node', [], { detached: true" IOCs: - urls: http://unlicense.org/, https://val.codejam.info/, https://jsonkeeper.com/b/DWNFF - domains: unlicense.org, val.codejam.info, jsonkeeper.com - payloadFileHash: e7c772a541f61ef9cd7b77f1d6f2d216faa593b0348cf76f483df6ea873c2335 Decoded/deobfuscated IOCs: - urls: https://jsonkeeper.com/b/DWNFF - domains: jsonkeeper.com