GCVE-110-OSM-2026-6553

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. ENTRY src/cache-manager.js (install-hook: node src/cache-manager.js) - Install Hook Executes Local JS File in package.json LOOT - Cryptocurrency Wallet Theft in src/system-monitor.js: "Seed phrase" DESTINATION - custom-c2: 2.27.62.51 (primary, plaintext) in src/system-monitor.js - bitcoinAddresses: bc1qxccwwz4525naaupwje4uv7l7t0emfeygf9rqqy (exfil, plaintext) - ethereumAddresses: 0x40c4121D89cb06A0254C1885e49BE90753a5A961 (exfil, plaintext) EXFIL - System Information Exfiltration in src/system-monitor.js: "os.hostname() + (os.userInfo ? os.userInfo().username : '')).digest('hex').subst..." - System Information Collection in src/cache-manager.js: "os.platform()" - Network Request in src/system-monitor.js: "https.request(" - System Information Collection in src/system-monitor.js: "os.userInfo()" OBFUSCATION - String Array Obfuscation in src/system-monitor.js: "[ 'abandon','ability','able','about','above','absent','absorb','abstract','absur..." ADDITIONAL FINDINGS - Shell Command Execution in src/cache-manager.js: "require('child_process')" - Silent Process Execution in src/cache-manager.js: "stdio: 'ignore'" PAYLOAD FILES src/system-monitor.js INDICATORS (IOCs) - crypto: 0x40c4121D89cb06A0254C1885e49BE90753a5A961, bc1qxccwwz4525naaupwje4uv7l7t0emfeygf9rqqy,TJrzJyVy9wkZU2AQcrdQKhfL3DXbWB1t2d - payloadFileHash: 9966976245fb0ea690f90eb567130aaa538bf99d1d75f5d34a2e701f0cb0d263