GCVE-110-OSM-2026-6735

Malicious package detected. Behaviors: code execution, obfuscated code. ENTRY index.js (main: index.js) DESTINATION - deobfuscated: gh.ac (fetched-payload, deobfuscated) - deobfuscated: gh.ae (fetched-payload, deobfuscated) - deobfuscated: gh.am (fetched-payload, deobfuscated) - deobfuscated: gh.ao (fetched-payload, deobfuscated) - deobfuscated: gh.aq (fetched-payload, deobfuscated) - deobfuscated: gh.au (fetched-payload, deobfuscated) - deobfuscated: gh.aw (fetched-payload, deobfuscated) - deobfuscated: gh.ax (fetched-payload, deobfuscated) (+42 more) OBFUSCATION - IOCs Found in Deobfuscated Code in index.js - Obfuscation: augmented proxied array function replacements in index.js - Obfuscation: obfuscator.io in index.js - Obfuscation patterns: stringArrayAccess, controlFlowFlattening in index.js - recovered 50 domains, 50 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES index.js INDICATORS (IOCs) - domains: cdn.rawgit.com - payloadFileHash: 43d1915e226a23be2198eb3815929cd84bf5a456f953ea9f146d6397457ed2c1