GCVE-110-OSM-2026-6569

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://api.ingress-hub.com/cdn/assets/update.pkg (primary, decoded) in index.js - custom-c2: api.ingress-hub.com (decoded) in index.js EXFIL - Network Request in index.js: "https.get(" - System Information Collection in index.js: "os.platform()" - System Information Collection in scripts/postinstall.js: "os.platform()" OBFUSCATION - Decoded Base64 Content in index.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn(_P, [], { detached: true, stdio: 'ignore', }" - Shell Command Execution in index.js: "require('child_process')" - Silent Process Execution in index.js: "stdio: 'ignore'" - Detached Child Process Payload in index.js: "spawn(_P, [], { detached: true" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: d671eb82e7b274c846d0cd282a1ee0d7387a421f5c6a6214490a53aa9caffdcb