GCVE-110-OSM-2026-6308

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY cdp_inject.js (bin: cdp_inject.js) DESTINATION - reconstructed: http://127.0.0.1:9222/json (primary, reconstructed) in cdp_inject.js - custom-c2: 127.0.0.1:9222 (reconstructed) in cdp_inject.js - discord-webhook: https://discord.com/api/webhooks/1512503888811659355/VyMd_oebkMgLJIDPvVubYbIkqPi_hCsRdWSmsLueLp22ycNmOlatd01ujOCMFyhfktlK (plaintext) in cdp_inject.js - custom-c2: https://api.groq.com/openai/v1/chat/completions (plaintext) in cdp_inject.js - custom-c2: api.groq.com (plaintext) in cdp_inject.js EXFIL - Webhook Data Exfiltration in cdp_inject.js: "discord.com/api/webhooks/1512503888811659355/VyMd_oebkMgLJIDPvVubYbIkqPi_hCsRdWS..." - System Information Exfiltration in cdp_inject.js: "__dirname, "demo_test.html"), ); ws.send( JSON.stringify({ id: Math.floor(Math.r..." - Data Encoding for Exfiltration in cdp_inject.js: "btoa(" - Data Encoding for Exfiltration in demo_test.html: "btoa(" - Network Request in cdp_inject.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in cdp_inject.js: "Buffer.from(b64, "base64")" - Deobfuscation Failed in cdp_inject.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in cdp_inject.js: "spawn(p, [`--remote-debugging-port=${CDP_PORT}`], { detached: true, stdio: "igno..." - Reconstructed Obfuscated URL in cdp_inject.js: "http://127.0.0.1:9222/json" - Publisher Has Other Malicious Packages - Shell Command Execution in cdp_inject.js: "child_process").spawn" - Silent Process Execution in cdp_inject.js: "stdio: "ignore"" - Detached Child Process Payload in cdp_inject.js: "spawn(p, [`--remote-debugging-port=${CDP_PORT}`], { detached: true" (+1 more) PAYLOAD FILES cdp_inject.js INDICATORS (IOCs) - payloadFileHash: e47745fe5437cd2e687dfd49cf62a3e0f4b36697192639e90d679d98f50e929d