GCVE-110-OSM-2026-5904

This package implements a classic remote loader attack: on postinstall, index.js fetches arbitrary JavaScript from `internal-mirror.southindia.cloudapp.azure.com:5000/1week_utils-helper.js` and executes it via `Module._compile`, giving the attacker full code execution in the installer's Node.js context with no visibility into what code is delivered at runtime. The use of `module.require` aliasing and a freshly registered single-version package with no repository are additional adversarial hygiene signals. The attacker model is supply-chain compromise via a dropper package that stages a second-stage payload from an attacker-controlled Azure VM endpoint. There is no legitimate explanation for fetching and compiling anonymous remote code on install. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json EXFIL - Network Request in index.js: "http.request(" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 5f0c3b78e84d418996839d84940be83ab75eb63db0090684cb7015b9ca5d5fb9