GCVE-110-OSM-2026-5986

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY index.js (install-hook: node index.js || true) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: 2.25.140.71 (primary, plaintext) in index.js EXFIL - Environment Variable Exfiltration in index.js: "process.env[k]; return a; }, {}), c: process.cwd(), t: Date.now() }); const req ..." - System Information Exfiltration in index.js: "os.userInfo().username, e: Object.keys(process.env).filter(k => /key|seed|secret..." - HTTP Data Exfiltration in index.js: "process.cwd(), t: Date.now() }); const req = https.request" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in index.js: "JSON.stringify({ h: os.hostname(), u: os" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 8936519f32d19d50089d55b700528b0a3149a27b8df271f19547c396948a8bdc