GCVE-110-OSM-2026-7494

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json EXFIL - Environment Variable Exfiltration in config/auth.js: "process.env},{'headers':{'x-app-request" OBFUSCATION - Decoded Base64 Content in index.js - Dynamic Base64 Decoding in config/auth.js: "atob(_0x3da2f0)" - Obfuscation: augmented proxied array function replacements in config/auth.js - Strings Extracted from Deobfuscated Code in config/auth.js - Obfuscation patterns: hexVariables in config/auth.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Very New NPM Publisher Account PAYLOAD FILES config/auth.js (+ index.js) INDICATORS (IOCs) - urls: https://gamboracle.vercel.app/api - domains: gamboracle.vercel.app - payloadFileHash: 19853fd48b01b000e0c01b05696373a28a87a4d861bc523e3037385518989312