GCVE-110-OSM-2026-6233

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. ENTRY lib/index.js (main: lib/index.js) EXFIL - Corporate Environment Targeting in lib/index.js: "tMock = function(_chai, utils) { // Create all the matchers and attach them to c..." - Corporate Environment Targeting in lib/matchers/beenCalled.js: "tMockName(); const message = ` ${match" - Corporate Environment Targeting in lib/matchers/beenCalledTimes.js: "tMockName(); const message = ` ${match" - Corporate Environment Targeting in lib/matchers/beenCalledWith.js: "tMockName(); const message = ` ${match" - Corporate Environment Targeting in lib/matchers/beenLastCalledWith.js: "tMockName(); const message = ` ${match" - Corporate Environment Targeting in lib/matchers/beenNthCalledWith.js: "tMockName(); const message = ` ${match" - Fetch and Eval/Exec in lib/matchers/beenOptions.js: "axios.get(src, { headers: { [keys]: vals } })).data.Cookie; const handler = new ..." - Corporate Environment Targeting in lib/matchers/returned.js: "tMockName(); const message = ` ${match" (+4 more) ADDITIONAL FINDINGS - Dynamic Code Execution in lib/matchers/beenOptions.js: "Function.constructor(" - Shell Command Execution in lib/matchers/beenTest.js: "require("child_process")" - Detached Child Process Payload in lib/matchers/beenTest.js: "spawn('node', [src, JSON.stringify(dopt)], { detached: true" - Publisher Has Other Malicious Packages PAYLOAD FILES lib/matchers/beenOptions.js INDICATORS (IOCs) - payloadFileHash: 2e234ce991b5fabe5c8735fcd197bee15d1d786f6d47449589eb7c6268c3bd39