GCVE-110-OSM-2026-5799

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. Entrypoint: index.js (install-hook: node index.js) Exfil: https://jsonkeeper.com/b/2P5FA (custom-c2, recovery: decoded in lib/index.js) Payload: lib/index.js Secondary files: [deobfuscated] lib/index.js Key findings: - Decoded Base64 Content in lib/index.js - Decoded Base64 Content in [deobfuscated] lib/index.js - Shell Command Execution in lib/index.js: "require('child_process')" - Dynamic Base64 Decoding in lib/index.js: "atob(DEV_API_KEY)" - Detached Child Process Payload in lib/index.js: "spawn('node', [], { detached: true" IOCs: - urls: http://babeljs.io/, https://jsonkeeper.com/b/2P5FA - domains: jongleberry.com, babeljs.io, jsonkeeper.com - emails: me@jongleberry.com - payloadFileHash: 7299e198ff6663d529291f28bcd2cd96c74785db12deca64b3676b05117d40eb Decoded/deobfuscated IOCs: - urls: https://jsonkeeper.com/b/2P5FA - domains: jsonkeeper.com