GCVE-110-OSM-2026-6139

Malicious package detected. Behaviors: code execution, obfuscated code, install-time execution. ENTRY install-hook.js (install-hook: node install-hook.js) - Install Hook Executes Local JS File in package.json DESTINATION - bitcoinAddresses: 31CQkLSL8L7fUJCQuLsmvt9QkJCkuty (exfil, plaintext) - bitcoinAddresses: 1CQoq2QUL77UJCuu1CQpa2QUK67UJCQ (exfil, plaintext) OBFUSCATION - Dynamic Base64 Decoding in install-hook.js: "Buffer.from(LAUNCHER_BIN_BASE64, 'base64')" - Base64 Encoded Payload in install-hook.js: ""DxjSQkFCQkJGQkJCvb1CQvpCQkJCQkJCAkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJ..." ADDITIONAL FINDINGS - Stealth Background Process Spawning in install-hook.js: "spawn('cmd', ['/c', 'start', '/b', TEMP_EXE], { cwd: TEMP_DIR, detached: true, w..." - Shell Command Execution in install-hook.js: "require('child_process')" - Silent Process Execution in install-hook.js: "stdio: 'ignore'" - Detached Child Process Payload in install-hook.js: "spawn('cmd', ['/c', 'start', '/b', TEMP_EXE], { cwd: TEMP_DIR, detached: true" PAYLOAD FILES install-hook.js INDICATORS (IOCs) - payloadFileHash: a1091c132f65787aa89cc2e3a689d4ccfbc31af88577615590f76daa204c0d66