GCVE-110-OSM-2026-6579

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. ENTRY lib/picker.js (install-hook: node lib/picker.js) - Install Hook Executes Local JS File in package.json EXFIL - Network Request in lib/picker.js: "https.get(" - System Information Collection in lib/picker.js: "os.homedir()" OBFUSCATION - Dynamic Base64 Decoding in lib/picker.js: "Buffer.from(b64, 'base64')" - Strings Extracted from Deobfuscated Code in lib/picker.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in lib/picker.js: "spawn('rundll32.exe', [dllPath, 'Run'], { detached: true, stdio: 'ignore', windo..." - Shell Command Execution in lib/picker.js: "require('child_process')" - Silent Process Execution in lib/picker.js: "stdio: 'ignore'" - Detached Child Process Payload in lib/picker.js: "spawn('rundll32.exe', [dllPath, 'Run'], { detached: true" - Brand New Package - Publisher Has Other Malicious Packages (+1 more) PAYLOAD FILES lib/picker.js INDICATORS (IOCs) - emails: elena@analysis-chart.io - payloadFileHash: d73d6e84bd46297974084f1a61b22db99d20e550399e170ca04cb8c7ebe41ff1