GCVE-110-OSM-2026-7498

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. ENTRY prepinstall.js (install-hook: node ./prepinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://api.jsonbin.io/v3/b/689dcd6043b1c97be91e2636 (primary, decoded) in prepinstall.js - custom-c2: api.jsonbin.io (decoded) in prepinstall.js EXFIL - Network Request in prepinstall.js: "axios.get(" OBFUSCATION - Decoded Base64 Content in prepinstall.js - Dynamic Base64 Decoding in prepinstall.js: "atob(HASH_KEY)" - Deobfuscation Failed in prepinstall.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in prepinstall.js: "require('child_process')" - Detached Child Process Payload in prepinstall.js: "spawn('node', [], { detached: true" PAYLOAD FILES prepinstall.js INDICATORS (IOCs) - urls: http://unlicense.org/, https://val.codejam.info/ - domains: unlicense.org, val.codejam.info - payloadFileHash: 4e29679b95b2b395230e1837a127e3486435b425fc9a43c7503d4229490a7c34