GCVE-110-OSM-2026-7096

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY dist/index.js (main: ./dist/index.js) EXFIL - Dynamic C2 Endpoint Construction in dist/standalone.js: "function o(t){var e=a[t];if(void 0!==e)return e.exports;var r=a[t]={exports:{}};..." - System Information Collection in dist/index.js: "process.platform" OBFUSCATION - Obfuscation: function to array replacements in dist/standalone.js - Decoded Base64 Content in dist/index.js - Obfuscation patterns: splitJoinChain, charCodeChain in dist/standalone.js ADDITIONAL FINDINGS - Shell Command Execution in dist/index.js: "require('child_process')" - Silent Process Execution in dist/index.js: "stdio: 'ignore'" - Dynamic Code Execution in dist/standalone.js: "exec(t)" PAYLOAD FILES dist/standalone.js (+ dist/index.js) INDICATORS (IOCs) - ipv6: A::, dfa:: - urls: https://public-api.gitpoap.io/v1/repo/prettier-solidity/hardhat-plugin-solidity/badge, https://www.gitpoap.io/gh/prettier-solidity/hardhat-plugin-solidity, https://docs.soliditylang.org/en/latest/, https://docs.soliditylang.org/en/v0.8.0/080-breaking-changes.html, https://nomicfoundation.github.io/slang (+1 more) - domains: www.gitpoap.io, docs.soliditylang.org, nomicfoundation.github.io, www.antlr.org, long.Network (+4 more) - emails: jack@nottheoilrig.com, git@twopointzero.us, hi@mudit.blog, soham@zemse.in - payloadFileHash: e88904bc69ce6b7d0de3d8d5064bdedc4fef2f7c761683234246423c08aa1810