GCVE-110-OSM-2026-6234

Malicious package detected. Behaviors: obfuscated code, install-time execution. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json OBFUSCATION - Obfuscation: augmented proxied array function replacements in scripts/postinstall.js - Decoded Hex Escape Content in scripts/postinstall.js (x250) - Hex Encoded Strings in scripts/postinstall.js: "'\x42\x4b\x35\x48\x76\x31\x44\x70\x6e\x32\x72\x6b\x43\x71'" - Unicode Escape Obfuscation in scripts/postinstall.js: "\x42\x4b\x35\x48\x76\x31\x44\x70\x6e\x32\x72\x6b\x43\x71" - Deobfuscation Failed in scripts/postinstall.js - Obfuscation patterns: hexHeavy in scripts/postinstall.js PAYLOAD FILES scripts/postinstall.js INDICATORS (IOCs) - urls: https://docs.welcome-onboarding-web.io/platform/mobile-focus-account-beta-merging, https://jira.welcome-onboarding-web.io/projects/PLATFORM, https://npm.welcome-onboarding-web.io, https://github.welcome-onboarding-web.io/platform/mobile-focus-account-beta-merging.git - emails: platform@welcome-onboarding-web.io - payloadFileHash: ace61e19b181f9dbd16cf1263ecf954dc90510cbc988931f0cae732e3acfcf9f