GCVE-110-OSM-2026-6733

Malicious package detected. Behaviors: code execution, obfuscated code. DESTINATION - deobfuscated: gh.ac (fetched-payload, deobfuscated) - deobfuscated: gh.ae (fetched-payload, deobfuscated) - deobfuscated: gh.am (fetched-payload, deobfuscated) - deobfuscated: gh.ao (fetched-payload, deobfuscated) - deobfuscated: gh.aq (fetched-payload, deobfuscated) - deobfuscated: gh.au (fetched-payload, deobfuscated) - deobfuscated: gh.aw (fetched-payload, deobfuscated) - deobfuscated: gh.ax (fetched-payload, deobfuscated) (+42 more) OBFUSCATION - IOCs Found in Deobfuscated Code in treeify.js - Obfuscation: augmented proxied array function replacements in treeify.js - Base64 Encoded Payload in treeify.js: "'W5hcLhWqW4KsW6jZW47dSSknAh7cQCoKW63cGuhdNwVcKCkMW63cMsuPWQHke2/cHSobW6ZdTmoqiCo..." - Obfuscation: obfuscator.io in treeify.js - Obfuscation patterns: stringArrayAccess, controlFlowFlattening in treeify.js - recovered 50 domains, 50 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Very New NPM Publisher Account PAYLOAD FILES treeify.js INDICATORS (IOCs) - urls: http://tolweb.org/Eukaryotes/3, http://lp.mit-license.org/ - domains: tolweb.org - payloadFileHash: 612b89ae1789817f9d1cca75f7c054010c1a1628afe538b31f1dced58c11a4b4