GCVE-110-OSM-2026-6440

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: 114.67.90.67 (primary, plaintext) in scripts/shell.js EXFIL - System Information Exfiltration in scripts/shell.js: "os.platform() + '_' + os.release()); const req = http.request" - Data Encoding for Exfiltration in scripts/shell.js: "encodeURIComponent(hostname" - Network Request in scripts/shell.js: "http.request(" - System Information Collection in scripts/shell.js: "os.userInfo()" ADDITIONAL FINDINGS - Stealth Background Process Spawning in scripts/postinstall.js: "spawn(process.execPath, [path.join(__dirname, 'shell.js')], { detached: true, st..." - Shell Command Execution in scripts/postinstall.js: "require('child_process')" - Silent Process Execution in scripts/postinstall.js: "stdio: 'ignore'" - Detached Child Process Payload in scripts/postinstall.js: "spawn(process.execPath, [path.join(__dirname, 'shell.js')], { detached: true" - Brand New Package PAYLOAD FILES scripts/shell.js (+ scripts/postinstall.js) INDICATORS (IOCs) - payloadFileHash: 9a9278d74630388e996735bb2e778f572010a2952c9304495f41cbd43adbecee