GCVE-110-OSM-2026-6170

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://betterminecraft.fun/nettspend.bat (primary, plaintext) in postinstall.js - custom-c2: betterminecraft.fun (plaintext) in postinstall.js EXFIL - Data Encoding for Exfiltration in dist/index.js: "encodeURIComponent(keyword)}&limit=${limit" - Network Request in dist/index.js: "http.get(" - Network Request in postinstall.js: "http.get(" - System Information Collection in postinstall.js: "process.platform" ADDITIONAL FINDINGS - Shell Command Execution in postinstall.js: "require('child_process')" - Silent Process Execution in postinstall.js: "windowsHide: true" - Shell Command Variable Setup in postinstall.js: "win32') { exec(`cmd /c "${tempFile}"`, { windowsH" - Stream Response to Execution in postinstall.js: "createWriteStream(tempFile); http.get(url, (response) => { response.pipe(file); ..." PAYLOAD FILES postinstall.js (+ dist/index.js) INDICATORS (IOCs) - urls: https://... - payloadFileHash: f51927f48193e74b892ea70f9bce90650da8a1bcc561619bb25c4f23e5a65cdc