GCVE-110-OSM-2026-6222

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. ENTRY bin/vibetime.mjs (bin: ./bin/vibetime.mjs) DESTINATION - custom-c2: http://121.196.224.82:3001 (primary, plaintext) in bin/vibetime.mjs - custom-c2: https://vibetime.dev/dashboard/settings (plaintext) in bin/vibetime.mjs - custom-c2: 121.196.224.82 (plaintext) in bin/vibetime.mjs EXFIL - Environment Variable Exfiltration in bin/vibetime.mjs: "process.env, stdin: process.stdin, stdout: process.stdout, stderr: process.stder..." - Corporate Environment Targeting in bin/vibetime.mjs: "tModel(content, currentModel) { if (!content) { return currentModel; } const set..." - Data Encoding for Exfiltration in bin/vibetime.mjs: "encodeURIComponent(String(part))).join" - Network Request in bin/vibetime.mjs: "https.request(" - System Information Collection in bin/vibetime.mjs: "os.platform()" - Suspicious Domain in bin/vibetime.mjs: "http://121.196.224.82" ADDITIONAL FINDINGS - Stealth Background Process Spawning in bin/vibetime.mjs: "spawn(process.execPath, args, { detached: true, stdio: "ignore", cwd: process.cw..." - Dynamic Code Execution in bin/vibetime.mjs: "exec(v)" - Silent Process Execution in bin/vibetime.mjs: "stdio: "ignore"" - Detached Child Process Payload in bin/vibetime.mjs: "spawn(process.execPath, args, { detached: true" PAYLOAD FILES bin/vibetime.mjs INDICATORS (IOCs) - payloadFileHash: 94dc9c0e639e485a8b407f4b36044cefe831e8f7482af264f5e852d6ce62a23f