GCVE-110-OSM-2026-6916

Malicious package detected. Behaviors: data exfiltration, network activity, install-time execution. ENTRY callback.js (install-hook: node callback.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://75.119.137.232:31337/depconfuse?pkg= (primary, plaintext) in callback.js - custom-c2: 75.119.137.232 (plaintext) in callback.js EXFIL - Data Encoding for Exfiltration in callback.js: "encodeURIComponent(pkg) + q("h", h) + q("u", u) + q("d", d) + q("reg", reg) + q(..." - System Information Collection in callback.js: "os.userInfo()" - Suspicious Domain in callback.js: "http://75.119.137.232" ADDITIONAL FINDINGS - Brand New Package PAYLOAD FILES callback.js INDICATORS (IOCs) - payloadFileHash: 7a2e6062e42ebbba325b5b8610c6d60072a6bcdfbc3c1aea2e524e92f55918a3