GCVE-110-OSM-2026-6935

Malicious package detected. Behaviors: data exfiltration, code execution. ENTRY index.js (main: index.js) EXFIL - System Information Collection in benchmarks/basic.bench.js: "process.platform" - System Information Collection in benchmarks/deep-object.bench.js: "process.platform" - System Information Collection in benchmarks/object.bench.js: "process.platform" ADDITIONAL FINDINGS - Shell Command Execution in benchmarks/runbench.js: "child_process').spawn" PAYLOAD FILES benchmarks/basic.bench.js (+ benchmarks/deep-object.bench.js, benchmarks/object.bench.js) INDICATORS (IOCs) - urls: https://www.contributor-covenant.org/version/2/0/code_of_conduct.html., https://www.contributor-covenant.org/translations., https://tldrlegal.com/license/mit-license, http://tldrlegal.com/license/mit-license, https://libraries.io/npm/pino-debugger - domains: tldrlegal.com, libraries.io - emails: conduct@alphacointech1010.io, security@alphacointech1010.io, security@json-douglas.io - payloadFileHash: 4d6cc6795f4a1c6c646b3b54618277db1c71a22e97fe6a7f3748fefeea70092a