GCVE-110-OSM-2026-7116

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY index.js (main: index.js) DESTINATION - custom-c2: https://jsonkeeper.com/b/SH5ZW (primary, decoded) in index.js - custom-c2: jsonkeeper.com (decoded) in index.js EXFIL - Network Request in index.js: "axios.get(" OBFUSCATION - Decoded Base64 Content in index.js - Dynamic Base64 Decoding in index.js: "atob(HASH_KEY)" - Deobfuscation Failed in index.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Shell Command Execution in index.js: "require("child_process")" - Detached Child Process Payload in index.js: "spawn("node", [], { detached: true" PAYLOAD FILES index.js INDICATORS (IOCs) - domains: divblox.com - emails: johan@divblox.com - payloadFileHash: ae11e36e28a20d61aad91dca3e04bb12de7b641e8db0e77413acf225549b4fcd