GCVE-110-OSM-2026-6442

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, install-time execution. ENTRY install.js (install-hook: node install.js) - Hidden NPM Install in install.js - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://brew.sh (primary, plaintext) in install.js - custom-c2: https://claude.ai/download/mac (plaintext) in install.js - custom-c2: https://claude.ai/download/windows (plaintext) in install.js - custom-c2: https://claude.ai/install.sh (plaintext) in install.js - custom-c2: brew.sh (plaintext) in install.js - custom-c2: claude.ai (plaintext) in install.js - urls: https://code.claude.com/docs (fetched-payload, plaintext) - urls: https://code.claude.com/docs/quickstart (fetched-payload, plaintext) (+1 more) EXFIL - System Information Collection in install.js: "os.platform()" - Curl/Wget Pipe to Shell in install.js: "curl -fsSL https://claude.ai/install.sh | bash" ADDITIONAL FINDINGS - Download Execute Delete Pattern in install.js: "execSync(`hdiutil detach "${mountPoint}"`, { stdio: 'inherit' }); if (fs.existsS..." - Shell Command Execution in install.js: "require('child_process')" - Silent Process Execution in install.js: "stdio: 'ignore'" - Brand New Package - Rapid Version Publishing SECONDARY PACKAGES (hidden install) - scan-only [OSM: malicious (high)] in install.js PAYLOAD FILES install.js INDICATORS (IOCs) - payloadFileHash: 9053bc9405bba102e2c157bebaf0b4d9b98736145c65b22d2aa20e786caddb8d