GCVE-110-OSM-2026-6486

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://testtesttestload.store (primary, plaintext) in shim/index.js - custom-c2: startup.sh (plaintext) in shim/index.js EXFIL - Dynamic C2 Endpoint Construction in shim/index.js: "function sendToServer(_0x86242b){const _0x15843f=a0_0x391f3f,_0x195fa9={'wQdaw':..." OBFUSCATION - Base64 Encoded Payload in shim/index.js: "'rgLTihbPzezPBgukicaGicaGrgLTigzZBWOGicaGicbeAw0GC2HLBgWkicaGicaGt24GrxjYB3iGuMv..." - Obfuscation: obfuscator.io in shim/index.js - Deobfuscation Failed in shim/index.js - Obfuscation patterns: hexVariables, hexHeavy in shim/index.js ADDITIONAL FINDINGS - Shell Command Execution in shim/index.js: "execSync(" - Indirect Function Constructor Access in shim/index.js: "['constructor']" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES shim/index.js INDICATORS (IOCs) - domains: reactjs.org - payloadFileHash: a04ea528a630adb229706c91b08d52ac600f18d7fdca5e22b8b1cbf5c8fe2a79