GCVE-110-OSM-2026-7414

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. ENTRY cjs/src/index.js (default-index: index.js) DESTINATION - reconstructed: https://tracker.bvgroup.co/remote/t42xNzaT2SnXbS_PsZ3gKDY-keTufZ2J?_tracker=hello (primary, reconstructed) in cjs/src/index.js - custom-c2: tracker.bvgroup.co (reconstructed) in cjs/src/index.js - custom-c2: https://tracker.bvgroup.co/remote/t42xNzaT2SnXbS_PsZ3gKDY-keTufZ2J (plaintext) in cjs/src/index.js EXFIL - Environment Variable Exfiltration in cjs/src/index.js: "process.env.HOSTNAME || '', platform: process.platform, arch: process.arch, pid:..." - Fetch and Eval/Exec in cjs/src/index.js: "fetch(ENDPOINT + '?_tracker=hello', { method: 'POST', headers: { 'Content-Type':..." - Environment Variable Exfiltration in src/index.js: "process.env.HOSTNAME || '', platform: process.platform, arch: process.arch, pid:..." - Fetch and Eval/Exec in src/index.js: "fetch(ENDPOINT + '?_tracker=hello', { method: 'POST', headers: { 'Content-Type':..." - System Information Collection in cjs/src/index.js: "process.platform" - System Information Collection in src/index.js: "process.platform" OBFUSCATION - recovered 2 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in cjs/src/index.js: "https://tracker.bvgroup.co/remote/t42xNzaT2SnXbS_PsZ3gKDY-keTufZ2J?_tracker=hell..." - Shell Command Execution in cjs/src/index.js: "require("child_process")" PAYLOAD FILES cjs/src/index.js (+ src/index.js) INDICATORS (IOCs) - urls: https://no-color.org/ - payloadFileHash: 0a33546a340b83acb87ab96ff7dad76aaa03ba571caa1662dd9af03d19caf974