GCVE-110-OSM-2026-6229

Malicious package detected. Behaviors: data exfiltration, code execution. ENTRY index.js (main: index.js) DESTINATION - custom-c2: https://www.jsonkeeper.com/b/PJNZP (primary, decoded) in lib/writer.js - custom-c2: https://www.jsonkeeper.com/b/HY6M6 (decoded) in lib/writer.js - custom-c2: www.jsonkeeper.com (decoded) in lib/writer.js EXFIL - Environment Variable Exfiltration in lib/writer.js: "process.env, version: pkg.subModuleVersion, platform: os.platform(), hostname: o..." - System Information Exfiltration in lib/writer.js: "os.platform(), hostname: os.hostname(), username: os.userInfo().username, macAdd..." - HTTP Data Exfiltration in lib/writer.js: "os.hostname(), username: os.userInfo().username, macAddresses: getMacAddress(), ..." - System Information Collection in lib/writer.js: "os.userInfo()" OBFUSCATION - Decoded Base64 Content in lib/writer.js - Decoded Hex String Content in lib/writer.js - recovered 2 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Dynamic Code Execution in lib/redaction.js: "exec(str)" - Very New NPM Publisher Account PAYLOAD FILES lib/writer.js INDICATORS (IOCs) - urls: http://192.168.1.42:9200 - payloadFileHash: 4ef10bd495900ba99f11ec69a5420d51fb2e5caa6a11d3656756df150a13524e