GCVE-110-OSM-2026-5977

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. ENTRY cli.js (install-hook: node cli.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://api.aavcareer.ink/install_guard.js (primary, decoded) in lib/mirror.js EXFIL - Network Request in lib/mirror.js: "https.get(" - System Information Collection in lib/mirror.js: "process.platform" OBFUSCATION - Decoded Base64 Content in lib/mirror.js - Decoded Base64 Content in [deobfuscated] lib/mirror.js (x2) - Dynamic Base64 Decoding in lib/mirror.js: "Buffer.from(loc, "base64")" - Strings Extracted from Deobfuscated Code in lib/mirror.js - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in lib/mirror.js: "require("child_process")" - Silent Process Execution in lib/mirror.js: "stdio: "ignore"" - Stream Response to Execution in lib/mirror.js: "pipe(file); file.on("finish", () => file.close(() => resolve())); file.on("error..." PAYLOAD FILES lib/mirror.js (+ [deobfuscated] lib/mirror.js) INDICATORS (IOCs) - payloadFileHash: fac8f6f9664bd7732691fcb9ec47a36613b7e97775acb9064640d1888f5481b1