GCVE-110-OSM-2026-6605

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code. ENTRY src/index.js (main: ./src/index.js) EXFIL - Environment Variable Exfiltration in src/utils/swap.js: "process.env.DEV_SECRET_KEY; const v = process.env.DEV_SECRET_VALUE; let retrycnt..." - Fetch and Eval/Exec in src/utils/swap.js: "axios.get(src, { headers: { [k]: v } })).data.config; const handler = new Functi..." - Payload Download from Paste Service in src/utils/swap.js: "jsonkeeper.com" - Network Request in src/utils/swap.js: "axios.get(" OBFUSCATION - Global Variable Shadowing in src/utils/swap.js: "const process = {" - Strings Extracted from Deobfuscated Code in src/utils/swap.js ADDITIONAL FINDINGS - Shell Command Execution in src/index.js: "require("child_process")" - Detached Child Process Payload in src/index.js: "spawn('node', [script, JSON.stringify(firstArg)], { detached: true" - Dynamic Code Execution in src/utils/swap.js: "Function.constructor(" - Publisher Has Other Malicious Packages PAYLOAD FILES src/utils/swap.js INDICATORS (IOCs) - payloadFileHash: cc7d174faa0309f8ad817b4527c6672f4ea33109180316bd7fb2a9e1f9033223