GCVE-110-OSM-2026-7383

Malicious package detected. Behaviors: obfuscated code, install-time execution. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json OBFUSCATION - Obfuscation: augmented proxied array function replacements in scripts/postinstall.js - Hex Encoded Strings in scripts/postinstall.js: "'\x41\x4d\x31\x52\x73\x33\x76\x4e\x41\x4d\x34'" - Unicode Escape Obfuscation in scripts/postinstall.js: "\x41\x4d\x31\x52\x73\x33\x76\x4e\x41\x4d\x34" - Decoded Hex Escape Content in scripts/postinstall.js (x180) - Deobfuscation Failed in scripts/postinstall.js - Obfuscation patterns: hexHeavy in scripts/postinstall.js PAYLOAD FILES scripts/postinstall.js INDICATORS (IOCs) - urls: https://docs.marketfront.io/platform/fashiononboardingpopup, https://jira.marketfront.io/projects/PLATFORM, https://npm.marketfront.io, https://github.marketfront.io/platform/fashiononboardingpopup.git - domains: marketfront.io - emails: platform@marketfront.io - payloadFileHash: 763e406418a5e73aa6b80a3fa9eab3b6850268fd2f58680547475fa7c8b57757