GCVE-110-OSM-2026-5996

Malicious package detected from a self-described "James Bonus" user. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://jsonkeeper.com/b/BN77K (primary, decoded) in lib/index.js - custom-c2: jsonkeeper.com (decoded) in lib/index.js EXFIL - Network Request in lib/index.js: "axios.get(" OBFUSCATION - Decoded Base64 Content in lib/index.js - Decoded Base64 Content in [deobfuscated] lib/index.js - Dynamic Base64 Decoding in lib/index.js: "atob(DEV_API_KEY)" - Strings Extracted from Deobfuscated Code in lib/index.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in lib/index.js: "require('child_process')" - Detached Child Process Payload in lib/index.js: "spawn('node', [], { detached: true" PAYLOAD FILES lib/index.js (+ [deobfuscated] lib/index.js) INDICATORS (IOCs) - urls: http://babeljs.io/ - domains: jongleberry.com, babeljs.io - emails: me@jongleberry.com - payloadFileHash: 044b4a3b8d15f9a085f9623f4ab5a28d03b34d96d652ca377cc4737db73912b8