GCVE-110-OSM-2026-5705

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. Entrypoint: index.js (main: index.js) Exfil: https://jsonkeeper.com/b/L435A (custom-c2, recovery: decoded in loader.js) Payload: loader.js Key findings: - Stealth Background Process Spawning in loader.js: "spawn(process.execPath, [tmpFile], { detached: true, stdio: "ignore", c..." - Download Execute Delete Pattern in loader.js: "writeFileSync(tmpFile, dropperCode, "utf8"); spawn(process.execPath, [tmpFile],..." - Decoded Base64 Content in loader.js - Shell Command Execution in loader.js: "require("child_process")" - Silent Process Execution in loader.js: "stdio: "ignore"" IOCs: - urls: https://jsonkeeper.com/b/L435A - domains: jsonkeeper.com - payloadFileHash: 91bcbd111d8efdb3e486c7ff2ec7d1d8b8710b971f196d909748e33e8263e1a5 Decoded/deobfuscated IOCs: - urls: https://jsonkeeper.com/b/L435A - domains: jsonkeeper.com