GCVE-110-OSM-2026-6692

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY install.js (install-hook: node install.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://dm-tech.ly:8001/poc-osc/exfil?d= (primary, plaintext) in index.js - custom-c2: dm-tech.ly (plaintext) in index.js EXFIL - Data Encoding for Exfiltration in index.js: "encodeURIComponent(JSON.stringify(exfilData" - Data Encoding for Exfiltration in install.js: "encodeURIComponent(data" - Network Request in index.js: "fetch('http:" - Network Request in install.js: "http.get(" - System Information Collection in install.js: "os.userInfo()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in install.js: "JSON.stringify({ timestamp: new Date().toISOString(), package: '@dx-ui/os" PAYLOAD FILES install.js INDICATORS (IOCs) - payloadFileHash: 1cde3aebf2c32f7d5e402719cd8a22fdda666fb04fbc65fff5ae481a27e02d94