GCVE-110-OSM-2026-7129

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY MMTemplate/index.js (default-index: index.js) PERSISTENCE - Startup Persistence in MMTemplate/src/navigation/MainTab.tsx: ".Profile" - Startup Persistence in MMTemplate/src/types/navigation.types.ts: ".Profile" DESTINATION - custom-c2: http://schemas.android.com/apk/res/android (primary, plaintext) in MMTemplate/android/app/src/main/AndroidManifest.xml EXFIL - Corporate Environment Targeting in MMTemplate/android/app/src/main/AndroidManifest.xml: "tMode="adjustResize" android:exported="true"> <intent-filter" OBFUSCATION - Suspicious Global Assignment in MMTemplate/lint_errors.txt: "global['!']=" ADDITIONAL FINDINGS - Shell Command Execution in release.js: "require('child_process')" PAYLOAD FILES MMTemplate/android/app/src/main/AndroidManifest.xml INDICATORS (IOCs) - ipv4: 6.1.7.5 - urls: http://rbenv.org/, https://rvm.io/, https://reactnavigation.org/, https://react.i18next.com/, https://formik.org/ (+14 more) - domains: rbenv.org, rvm.io, reactnavigation.org, react.i18next.com, formik.org (+10 more) - payloadFileHash: e3517aa998a5cbe6c10b54b6a9762e2ee5b381e3a04323ad7ccefba5a476dcb8