GCVE-110-OSM-2026-6494

This package implements a C2 token-fetch pattern: base64-encoded strings `_cfgA` and `_cfgB` decode to `https://pastebin.com/raw/wh34RDBe` and `https://api.github.com/repos/xyroorynzz/Alice/contents/Alicev2.json`. The `_resolveRegistry()` function fetches a token from Pastebin, then uses it as a Bearer auth header to retrieve a JSON payload from the attacker's GitHub repo, which is then parsed and used to validate/match user inputs via `_verifyCompatibility()`. The truncated `patchBaileys()` function targets `@whiskeysockets/baileys` (a WhatsApp bot library), strongly suggesting the attacker goal is to backdoor WhatsApp session credentials or message interception. The OCR wrapper is entirely cover — the malicious logic is hidden behind obfuscated base64 constants and silently called during normal library usage. ENTRY index.js (main: index.js) DESTINATION - custom-c2: https://pastebin.com/raw/wh34RDBe (primary, decoded) in index.js - custom-c2: https://api.github.com/repos/xyroorynzz/Alice/contents/Alicev2.json (decoded) in index.js - custom-c2: pastebin.com (decoded) in index.js EXFIL - Network Request in index.js: "axios.get(" OBFUSCATION - Decoded Base64 Content in index.js (x2) - Decoded Base64 Content in [deobfuscated] index.js (x2) - Dynamic Base64 Decoding in index.js: "Buffer.from(s, 'base64')" - Strings Extracted from Deobfuscated Code in index.js - recovered 2 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Malicious Dependency Detected in package.json PAYLOAD FILES index.js (+ [deobfuscated] index.js) INDICATORS (IOCs) - payloadFileHash: fe47c69541ba0abe54a959850fc09080ab57a9c916efcec3cdc77e75ae12d97e