GCVE-110-OSM-2026-5991

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. ENTRY scripts/postinstall.cjs (install-hook: node scripts/postinstall.cjs) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: 213.218.160.189 (primary, plaintext) in scripts/postinstall.cjs EXFIL - Network Request in scripts/postinstall.cjs: "http.get(" - System Information Collection in scripts/postinstall.cjs: "os.userInfo()" OBFUSCATION - Dynamic Base64 Decoding in scripts/postinstall.cjs: "Buffer.from(enc, 'base64')" - Deobfuscation Failed in scripts/postinstall.cjs ADDITIONAL FINDINGS - Stealth Background Process Spawning in scripts/postinstall.cjs: "spawn(nodeExe, [tmpFile], { detached: true, stdio: 'ignore', windowsHide: true, ..." - Shell Command Execution in scripts/postinstall.cjs: "require('child_process')" - Silent Process Execution in scripts/postinstall.cjs: "stdio: 'ignore'" - Detached Child Process Payload in scripts/postinstall.cjs: "spawn(nodeExe, [tmpFile], { detached: true" - Platform Detection with Data Collection in scripts/postinstall.cjs: "JSON.stringify({ h: _h, u: _u, p: _p, a: os.arch() })).toString('base64'); const..." - Brand New Package (+2 more) PAYLOAD FILES scripts/postinstall.cjs INDICATORS (IOCs) - payloadFileHash: bb1253d7958c76ae002b219dc29bc929ba121d910d0319ea784093bbfb969191