GCVE-110-OSM-2026-5792

Malicious package detected. Behaviors: data exfiltration, code execution. The package presents as a legitimate GitHub CDN uploader, but the behaviour it exhibits is suspiciously similar to exfiltration upload functions. Entrypoint: src/index.cjs (main: ./src/index.cjs) Payload: src/upload.cjs Secondary files: src/upload.js, src/index.cjs The package presents as a legitimate GitHub CDN uploader, and most of the git/shell activity in `src/upload.cjs` (execSync copy→git-add→commit→push→unlink) is plausible for that stated purpose. However, the entrypoint `src/index.cjs` makes a bare `await uploader()` call from `./uploader.cjs` immediately after completing the upload, with no visible relationship to the CDN upload workflow — this is a classic 'piggyback execution' pattern where a secondary payload is hidden behind legitimate functionality. The `uploader.cjs` source is not provided in evidence, making its behavior opaque. Compounding signals: brand-new publisher account (11 days, 2 packages, no repository), and the second package `jarrhelpzss` is itself an anomalous name. Key findings: - Download Execute Delete Pattern in src/upload.cjs: "execSync(`cp ${fileName} temp_backup/`, { shell: '/bin/bash' }) execSync(`cd t..." - Download Execute Delete Pattern in src/upload.js: "execSync(`cp ${fileName} temp_backup/`, { shell: '/bin/bash' }) execSync(`cd t..." - Shell Command Execution in src/upload.cjs: "require('child_process')" - Shell Command Execution in src/upload.js: "execSync(" IOCs: - payloadFileHash: ceff960d57f62014f7603c26a9b7d35a8261adf24eaeea5bd80099579721dde9