GCVE-110-OSM-2026-6173

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY dist/index.js (main: dist/index.js) - Postinstall Script in package.json: ""postinstall": "npx playwright install chromium"" DESTINATION - reconstructed: https://v3.football.api-sports.io/fixtures (primary, reconstructed) in dist/index.js - reconstructed: https://www.uol.com.br/esporte/futebol/central-de-jogos/ (reconstructed) in dist/uol.js - urls: https://v3.football.api-sports.io/fixtures`; (c2, plaintext) - urls: http://cache.xui-managers.site/global-cache (c2, plaintext) - urls: https://www.uol.com.br/esporte/futebol/central-de-jogos/`; (c2, plaintext) - domains: api-sports.io (c2, plaintext) - domains: v3.football.api-sports.io (c2, plaintext) - domains: www.uol.com.br (c2, plaintext) EXFIL - Environment Variable Exfiltration in src/index.ts: "process.env};await axios" - Network Request in src/index.ts: "axios.get(" - Network Request in src/uol.ts: "axios.get(" OBFUSCATION - recovered 2 urls, 2 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in dist/index.js: "https://v3.football.api-sports.io/fixtures" PAYLOAD FILES src/index.ts INDICATORS (IOCs) - ipv4: 145.0.0.0 - urls: https://www.futebolnatv.com.br/jogos-hoje/`;, https://www.futebolnatv.com.br/jogos-amanha/`;, https://www.futebolnatv.com.br/jogos-ontem/`;, https://docs.renovatebot.com/renovate-schema.json - domains: www.futebolnatv.com.br, e.imguol.com, docs.renovatebot.com - payloadFileHash: f1c4f5f2824b08d4384dd95ae3008acafcebd32600bd6637e8c8c41093e0f2ee