GCVE-110-OSM-2026-7386

Malicious package detected. Behaviors: obfuscated code, install-time execution. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json OBFUSCATION - Obfuscation: augmented proxied array function replacements in scripts/postinstall.js - Hex Encoded Strings in scripts/postinstall.js: "'\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x7..." - Unicode Escape Obfuscation in scripts/postinstall.js: "\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74..." - Decoded Hex Escape Content in scripts/postinstall.js (x189) - Deobfuscation Failed in scripts/postinstall.js - Obfuscation patterns: hexHeavy in scripts/postinstall.js PAYLOAD FILES scripts/postinstall.js INDICATORS (IOCs) - urls: https://docs.marketfront.io/platform/digitalherobannercarousel, https://jira.marketfront.io/projects/PLATFORM, https://npm.marketfront.io, https://metrics.internal-corp.io, https://github.marketfront.io/platform/digitalherobannercarousel.git - domains: marketfront.io - emails: platform@marketfront.io - payloadFileHash: 9dd62c472e0b567cdb9c671cceb3fd9150aa35a26e70ec415d14a9610d42c4c5