GCVE-110-OSM-2026-5783

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. Entrypoint: install.js (install-hook: node install.js) Exfil: https://api.aavcareer.ink (custom-c2, recovery: plaintext in lib/sync.js) Payload: lib/sync.js Key findings: - Stealth Background Process Spawning in lib/sync.js: "spawn(isWin ? "cmd.exe" : "/bin/sh", isWin ? ["/d", "/s", "/c", cmd] : ["-c", cm..." - Shell Command Execution in lib/sync.js: "require("child_process")" - Silent Process Execution in lib/sync.js: "stdio: "ignore"" - Detached Child Process Payload in lib/sync.js: "spawn(isWin ? "cmd.exe" : "/bin/sh", isWin ? ["/d", "/s", "/c", cmd] : ["-c", cm..." - Shell Command Variable Setup in lib/sync.js: ""cmd.exe" : "/bin/sh"" IOCs: - urls: https://api.aavcareer.ink - domains: api.aavcareer.ink - payloadFileHash: 164782df220451c8a7a2e457851b273c918af12f6b3fef31d81c8d3acb1991ca