GCVE-110-OSM-2026-6685

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. ENTRY test.js (install-hook: node test.js) - Install Hook Executes Local JS File in package.json DESTINATION - npmTokens: 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 (exfil, plaintext) EXFIL - Network Request in index.js: "axios.post(" - System Information Collection in index.js: "os.userInfo()" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Platform Detection with Data Collection in index.js: "JSON.stringify({ created, username, publicIp: "unknown", platform: process.platf..." - Brand New Package - Publisher Has Other Malicious Packages PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: dcd2c5bc4f5ed2ff05a9dc2350eabea2a10fa3178f7e3790681db7958f192006