GCVE-110-OSM-2026-6175

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://jsonkeeper.com/b/BN77K (primary, decoded) in lib/index.js - custom-c2: jsonkeeper.com (decoded) in lib/index.js EXFIL - Network Request in lib/index.js: "axios.get(" OBFUSCATION - Decoded Base64 Content in lib/index.js - Dynamic Base64 Decoding in lib/index.js: "atob(DEV_API_KEY)" - Deobfuscation Failed in lib/index.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in lib/index.js: "require('child_process')" - Detached Child Process Payload in lib/index.js: "spawn('node', [], { detached: true" - Brand New Package PAYLOAD FILES lib/index.js INDICATORS (IOCs) - urls: http://babeljs.io/ - domains: jongleberry.com, babeljs.io - emails: me@jongleberry.com - payloadFileHash: 72a8a52cbb98921b689173423a2970d414fd2c32e3a5aea47db7be9550024a10