GCVE-110-OSM-2026-7372

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. ENTRY install.js (install-hook: node install.js) - Install Hook Executes Local JS File in package.json EXFIL - HTTP Data Exfiltration in install.js: "fetchKey(); const token = xorDecode(ENC_TOKEN, key); const chatId = xorDecode(EN..." - Git Configuration Access in install.js: ".gitconfig" - Network Request in install.js: "https.request(" - System Information Collection in install.js: "os.userInfo()" ADDITIONAL FINDINGS - Download Execute Delete Pattern in install.js: "execSync(`powershell -Command "Compress-Archive -Path '${tmp}\\*' -DestinationPa..." - Shell Command Execution in install.js: "require('child_process')" - Very New NPM Publisher Account PAYLOAD FILES install.js INDICATORS (IOCs) - payloadFileHash: 01f53730702246a90de7069ab8607439e5eccec3943894b2e6dd86a3ef540fb0