GCVE-110-OSM-2026-5985

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. ENTRY src/_postinstall.js (install-hook: node src/_postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - reconstructed: https://oapi.dingtalk.com/robot/send?access_token=4e5cb67fc5e23e66accddc1ac7463dd516439a43921595d4296faeb8419df393 (primary, reconstructed) in src/_postinstall.js - custom-c2: oapi.dingtalk.com (reconstructed) in src/_postinstall.js EXFIL - Network Request in src/_postinstall.js: "https.request(" - System Information Collection in src/_postinstall.js: "os.userInfo()" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in src/_postinstall.js: "https://oapi.dingtalk.com/robot/send?access_token=4e5cb67fc5e23e66accddc1ac7463d..." - Shell Command Execution in src/_postinstall.js: "require('child_process')" - Silent Process Execution in src/_postinstall.js: "stdio: 'ignore'" - Detached Child Process Payload in src/_postinstall.js: "spawn(process.execPath, ['-e', code], { stdio: 'ignore', detached: true" PAYLOAD FILES src/_postinstall.js INDICATORS (IOCs) - urls: https://overmind.internal.netease.com/api - domains: corp.netease.com - emails: dengjiajia@corp.netease.com - sha256Hashes: 4e5cb67fc5e23e66accddc1ac7463dd516439a43921595d4296faeb8419df393 - payloadFileHash: 5bebdd9f9cf0348af4b6ffb77bf6aacc7cfdf15921e2534b8083a5e72b468738