GCVE-110-OSM-2026-7071

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. ENTRY install.js (install-hook: node install.js) - Install Hook Executes Local JS File in package/package.json - Install Hook Executes Local JS File in package.json - Postinstall Script in package/package.json - Postinstall Script in package.json DESTINATION - custom-c2: http://{target (primary, plaintext) in arm-aliases.sh - custom-c2: 154.57.164.76 (plaintext) in arm-aliases.sh EXFIL - Environment Variable Exfiltration in install.js: "JSON.stringify(process.env)" - Sensitive File Access in install.js: ""/home/node/.npmrc"" - Data Encoding for Exfiltration in arm-aliases.sh: "json.dumps({"manifest": manifest}).encode" - Git Configuration Access in install.js: ".git/config" - Data Encoding for Exfiltration in package/arm-aliases.sh: "json.dumps({"manifest": manifest}).encode" - Data Encoding for Exfiltration in package/install.js: "Buffer.from(data.cwd).toString("base64")" - Data Encoding for Exfiltration in package/publish-and-arm.sh: "json.dumps({"manifest": manifest}).encode" - Data Encoding for Exfiltration in publish-and-arm.sh: "json.dumps({"manifest": manifest}).encode" (+6 more) ADDITIONAL FINDINGS - Shell Command Execution in install.js: "require("child_process")" - Platform Detection with Data Collection in install.js: "JSON.stringify({ manifest }); const req = http.request({ hostname: targetHos" - Brand New Package PAYLOAD FILES install.js INDICATORS (IOCs) - payloadFileHash: 814888a1ffd0e0893681983c74f5b239972e850afbf9b32687af29837a49cb49