GCVE-110-OSM-2026-5833

Malicious package detected. Behaviors: data exfiltration, code execution. Entrypoint: index.js (main: index.js) Exfil: http://0.0.0.0:4873/-/user/org.couchdb.user:pwn99 (custom-c2, recovery: plaintext in index.js) Payload: index.js Key findings: - Shell Command Execution in index.js: "require('child_process')" - Data Encoding for Exfiltration in index.js: "Buffer.from("pwn99:pwn99pass").toString("base64")" - Very New NPM Publisher Account - Rapid Version Publishing IOCs: - urls: http://0.0.0.0:4873/-/user/org.couchdb.user:pwn99, http://10.0.0.145:8888/step1_reg?r=, http://0.0.0.0:4873/uhclabs_local_check, http://10.0.0.145:8888/step2_versions?v=, http://10.0.0.145:8888/rootflag (+5 more) - payloadFileHash: afaac17092222c149e8bdaa321ede7ec1cc1b8a98b3d5ba20e49608e60afe279