GCVE-110-OSM-2026-7589

This package is a classic dropper/loader malware. On preinstall, index.js executes _fetch(), which downloads a platform-specific binary ('WinService.exe' on Windows, 'WinMetrics' on Linux) from the obfuscated C2 host 'sloth-antagonist.vercel.app' (constructed via char-code arrays to evade static detection), writes it to a hidden app directory, makes it executable, and spawns it as a detached process with suppressed I/O (windowsHide: true on Windows) so the payload survives parent exit and leaves no visible window. The obfuscation is deliberate and purposeful — the host, path, and binary names are all assembled at runtime from integer arrays — and deobfuscation confirmed the C2 domain. The nominal pack/unpack/checksum API surface is a thin cover story; the malicious _fetch() call is embedded directly inside the exported pack() function so it fires on every invocation as well as on install. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: sloth-antagonist.vercel.app (primary, deobfuscated) in index.js EXFIL - System Information Collection in index.js: "process.platform" OBFUSCATION - IOCs Found in Deobfuscated Code in index.js - Obfuscation patterns: charCodeArrayBuild in index.js - recovered 1 domains, 1 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn(dest, [], { detached: true, stdio: 'ignore', ...(isWindows && { windowsHid..." - Download Execute Delete Pattern in index.js: "createWriteStream, mkdirSync, existsSync, chmodSync } = require('fs'); const { g..." - Shell Command Execution in index.js: "require('child_process')" - Silent Process Execution in index.js: "stdio: 'ignore'" - Detached Child Process Payload in index.js: "spawn(dest, [], { detached: true" - Stream Response to Execution in index.js: "createWriteStream, mkdirSync, existsSync, chmodSync } = require('fs'); const { g..." PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 705a3639e1d0db15545b0ca0da8178d281ef5a460cdcc17a5b02445db0f28e69