GCVE-110-OSM-2026-6676

Malicious package detected. Behaviors: obfuscated code. ENTRY index.js (main: index.js) DESTINATION - ethereumAddresses: 0x742d35Cc6634C0532925a3b844Bc454e44381440 (exfil, plaintext) - deobfuscated: api.trongrid.io (fetched-payload, deobfuscated) - deobfuscated: fullnode.mainnet.aptoslabs.com (fetched-payload, deobfuscated) - deobfuscated: bsc-dataseed.binance.org (fetched-payload, deobfuscated) - deobfuscated: bsc-rpc.publicnode.com (fetched-payload, deobfuscated) OBFUSCATION - IOCs Found in Deobfuscated Code in index.js - Obfuscation: function to array replacements in index.js - Obfuscation patterns: underscoreDollarVars, splitJoinChain in index.js - recovered 2 urls, 4 domains, 4 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES index.js INDICATORS (IOCs) - urls: https://api.trongrid.io/v1/accounts/, https://fullnode.mainnet.aptoslabs.com/v1/accounts/ - payloadFileHash: 0956c1b99ac68710864c32ffb75c5fcfc736d4a55ebd3909d4834fbd765b417b