GCVE-110-OSM-2026-5994

Drops bundled executables (ai-task-runner, ai-task-worker) to a persistent hidden user directory (~/.exocortex/bin/) via a postinstall lifecycle hook. The primary package bundle (dist/index.js, ~1.35MB) is obfuscated with atob-base64-literals encoding; zig-solver matched the rule but decoded 0 strings, leaving obfuscation unresolved. No confirmed C2, exfiltration, or persistence across reboot/login was established. Package is gated pending binary analysis of dropped executables and resolution of the obfuscated bundle. scripts/postinstall.cjs copies ai-task-runner and ai-task-worker from the package bin/ directory to ~/.exocortex/bin/ and sets chmod 0o755. The obfuscated dist/index.js bundle (~1.35MB) remains unanalyzed; full capability set unknown.