GCVE-110-OSM-2026-6024

Suspected dependency confusion attack. Behaviors: data exfiltration, code execution, install-time execution. ENTRY lib/setup.js (install-hook: node lib/setup.js) - Install Hook Executes Local JS File in package.json EXFIL - System Information Collection in lib/setup.js: "os.platform()" ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn(name, cmd, args, opts) { args = args || []; opts = Object.assign({ detache..." - Shell Command Execution in index.js: "require('child_process')" - Silent Process Execution in index.js: "stdio: 'ignore'" - Detached Child Process Payload in index.js: "spawn(name, cmd, args, opts) { args = args || []; opts = Object.assign({ detache..." PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: b0e5ae4d1e79163d8d48bcb9f31b4d97699b2a14e10f9b1a5d258e8f2a1d259d