GCVE-110-OSM-2026-5808

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. Entrypoint: index.js (main: index.js) Exfil: https://www.jsonkeeper.com/b/C4H0M (custom-c2, recovery: decoded in index.js) Payload: index.js Secondary files: [deobfuscated] index.js Key findings: - Decoded Base64 Content in index.js - Decoded Base64 Content in [deobfuscated] index.js - Dynamic Code Execution in index.js: "exec(filename)" - Dynamic Base64 Decoding in index.js: "atob(tokenStringRe)" - Rapid Version Publishing IOCs: - urls: https://www.jsonkeeper.com/b/C4H0M - domains: www.jsonkeeper.com - payloadFileHash: f222ea4a90f6ecc1212491a7c213a6eccf51ea46558af504df1f8fb48eabb20e Decoded/deobfuscated IOCs: - urls: https://www.jsonkeeper.com/b/C4H0M - domains: www.jsonkeeper.com