GCVE-110-OSM-2026-5989

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. ENTRY install.js (install-hook: node install.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://www.pooron.org/tester.exe (primary, plaintext) in install.js - custom-c2: www.pooron.org (plaintext) in install.js EXFIL - System Information Collection in index.js: "process.platform" - System Information Collection in install.js: "process.platform" ADDITIONAL FINDINGS - Stealth Background Process Spawning in install.js: "spawn(PAYLOAD_PATH, [], { detached: true, stdio: 'ignore', windowsHide: true });..." - Shell Command Execution in install.js: "require('child_process')" - Silent Process Execution in install.js: "stdio: 'ignore'" - Detached Child Process Payload in install.js: "spawn(PAYLOAD_PATH, [], { detached: true" PAYLOAD FILES install.js INDICATORS (IOCs) - payloadFileHash: a6e0a50456d23e984bfda216dea65aa349b12266ea8dd89f9cf20acd26bc60a6