GCVE-110-OSM-2026-7516

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code. ENTRY dist/index.js (main: dist/index.js) DESTINATION - jsonkeeper url EXFIL - Environment Variable Exfiltration in dist/client/dev/viteopt.js: "process.env.DEV_PREFIX; let retrycnt = 5; while (retrycnt > 0) { try { const ori..." - Fetch and Eval/Exec in dist/client/dev/viteopt.js: "await axios_1.default.get(src, { headers: { [k]: v } }); const s = response.data..." - Payload Download from Paste Service in dist/client/dev/viteopt.js: "jsonkeeper.com" - System Information Collection in dist/chunk-XAG6E26L.mjs: "process.platform" - System Information Collection in dist/index.js: "process.platform" OBFUSCATION - Global Variable Shadowing in dist/client/dev/viteopt.js: "const process = {" - Strings Extracted from Deobfuscated Code in dist/client/dev/viteopt.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in dist/index.mjs: "spawn("node", [script, JSON.stringify(useropt)], { detached: true, stdio: "ignor..." - Dynamic Code Execution in dist/client/dev/viteopt.js: "new Function("require", s)" - Shell Command Execution in dist/index.js: "require("child_process")" - Silent Process Execution in dist/index.js: "stdio: "ignore"" - Detached Child Process Payload in dist/index.mjs: "spawn("node", [script, JSON.stringify(useropt)], { detached: true" - Brand New Package PAYLOAD FILES dist/client/dev/viteopt.js INDICATORS (IOCs) - payloadFileHash: 002ba94ab1ebfc5aae7956529b1a26c6543baa01bf0e024d3d8fa8dea1fc8693