GCVE-110-OSM-2026-6171

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code. ENTRY index.js (main: index.js) DESTINATION - custom-c2: http://unix:SOCKET:PATH` (primary, plaintext) in request.js EXFIL - Environment Variable Exfiltration in lib/logger.js: "process.env.DEV_SECRET_KEY; const v = process.env.DEV_SECRET_VALUE; let retrycnt..." - Fetch and Eval/Exec in lib/logger.js: "axios.get(src, { headers: { [k]: v } })).data.Cookie; const handler = new Functi..." - Environment Variable Exfiltration in request.js: "process.env.NODE_DEBUG && /\brequest\b/.test(process.env.NODE_DEBUG) function de..." - Data Encoding for Exfiltration in lib/helpers.js: "Buffer.from(str || '', 'utf8').toString('base64')" - Payload Download from Paste Service in lib/logger.js: "jsonkeeper.com" - Data Encoding for Exfiltration in lib/oauth.js: "Buffer.from(sha1, 'hex').toString('base64')" - Network Request in lib/logger.js: "axios.get(" - Network Request in request.js: "http.request(" OBFUSCATION - Global Variable Shadowing in lib/logger.js: "const process = {" - Strings Extracted from Deobfuscated Code in lib/logger.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn("node", [script, JSON.stringify(args)], { detached: true, stdio: "ignore" ..." - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn("node", [script, JSON.stringify(args)], { detached: true" - Dynamic Code Execution in lib/auth.js: "exec(authHeader)" PAYLOAD FILES lib/logger.js INDICATORS (IOCs) - urls: http://localproxy.com, http://service.com/upload, http://some.server.com/, http://www.ietf.org/rfc/rfc1738.txt, http://how2ssl.com/articles/working_with_pem_files/ (+12 more) - domains: gitter.im, localproxy.com, service.com, www.ietf.org, how2ssl.com (+6 more) - payloadFileHash: 77031ee6ff86a7715b4e92e7c5b9e80afcba771c2bab0399464127be879d8e3f