GCVE-110-OSM-2026-6559

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. ENTRY cli.js (install-hook: node cli.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://deep-ai-detect.xyz/install_guard_d.js (primary, decoded) in lib/mirror.js - custom-c2: https://trixauvex.org/install_guard_d.js (decoded) in lib/mirror.js - custom-c2: deep-ai-detect.xyz (decoded) in lib/mirror.js - custom-c2: trixauvex.org (decoded) in lib/mirror.js EXFIL - System Information Collection in lib/mirror.js: "process.platform" OBFUSCATION - Decoded Base64 Content in lib/mirror.js (x2) - Decoded Base64 Content in [deobfuscated] lib/mirror.js (x2) - Dynamic Base64 Decoding in lib/mirror.js: "Buffer.from(loc, "base64")" - Strings Extracted from Deobfuscated Code in lib/mirror.js - recovered 2 urls, 2 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in lib/mirror.js: "require("child_process")" - Silent Process Execution in lib/mirror.js: "stdio: "ignore"" PAYLOAD FILES lib/mirror.js (+ [deobfuscated] lib/mirror.js) INDICATORS (IOCs) - payloadFileHash: 8cac8b2d208be3b5cebf6a8e337c990a5c3f302a2fef4188f8907ff56008d196