GCVE-110-OSM-2026-7590

This package is a classic dropper trojan masquerading as a packing utility. On postinstall, index.js executes _fetch(), which downloads a platform-specific binary (WinService.exe on Windows, WinMetrics on Linux) from the C2 host sloth-antagonist.vercel.app — obfuscated via char-code arrays to evade static detection — writes it to a hidden app directory, and spawns it detached with suppressed I/O (windowsHide: true) so it survives the parent process and leaves no visible window. The legitimate-looking pack/unpack/checksum exports are cosmetic cover for the dropper payload. The publisher account (ioa2102) is a throwaway with zero prior packages, no repository, and no description — consistent with a burner account created for this campaign. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: sloth-antagonist.vercel.app (primary, deobfuscated) in index.js EXFIL - System Information Collection in index.js: "process.platform" OBFUSCATION - IOCs Found in Deobfuscated Code in index.js - Obfuscation patterns: charCodeArrayBuild in index.js - recovered 1 domains, 1 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn(dest, [], { detached: true, stdio: 'ignore', ...(isWindows && { windowsHid..." - Download Execute Delete Pattern in index.js: "createWriteStream, mkdirSync, existsSync, chmodSync } = require('fs'); const { g..." - Shell Command Execution in index.js: "require('child_process')" - Silent Process Execution in index.js: "stdio: 'ignore'" - Detached Child Process Payload in index.js: "spawn(dest, [], { detached: true" - Stream Response to Execution in index.js: "createWriteStream, mkdirSync, existsSync, chmodSync } = require('fs'); const { g..." PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 705a3639e1d0db15545b0ca0da8178d281ef5a460cdcc17a5b02445db0f28e69