GCVE-110-OSM-2026-6726

Malicious package detected. Behaviors: obfuscated code, install-time execution. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - deobfuscated: a0b2.aU (fetched-payload, deobfuscated) - deobfuscated: a0b2.aW (fetched-payload, deobfuscated) - deobfuscated: a0b2.aX (fetched-payload, deobfuscated) - deobfuscated: a0b2.aZ (fetched-payload, deobfuscated) - deobfuscated: a0b2.bd (fetched-payload, deobfuscated) - deobfuscated: a0b2.bf (fetched-payload, deobfuscated) - deobfuscated: a0b2.bi (fetched-payload, deobfuscated) - deobfuscated: a0b2.bl (fetched-payload, deobfuscated) (+42 more) OBFUSCATION - IOCs Found in Deobfuscated Code in scripts/postinstall.js - Obfuscation: augmented proxied array function replacements in scripts/postinstall.js - Decoded Hex Escape Content in scripts/postinstall.js (x220) - Hex Encoded Strings in scripts/postinstall.js: "'\x57\x36\x79\x4f\x45\x43\x6b\x4a\x57\x4f\x39\x2f'" - Unicode Escape Obfuscation in scripts/postinstall.js: "\x57\x36\x79\x4f\x45\x43\x6b\x4a\x57\x4f\x39\x2f" - Obfuscation patterns: hexHeavy in scripts/postinstall.js - recovered 50 domains, 50 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages PAYLOAD FILES scripts/postinstall.js INDICATORS (IOCs) - urls: https://docs.help-forms.io/platform/application-aff, https://jira.help-forms.io/projects/PLATFORM, https://npm.help-forms.io, https://github.help-forms.io/platform/application-aff.git - emails: platform@help-forms.io - payloadFileHash: 5083ea610491d38554c73051ba56a0460a47302d39e386feff26697cc4f5616d