GCVE-110-OSM-2026-7642

Suspected dependency confusion attack. Behaviors: data exfiltration, code execution, network activity. ENTRY index.js (main: index.js) DESTINATION - custom-c2: https://api.jsonsilo.com/public/df71fd55-4f0c-4326-9b5b-a285e38023a5 (primary, plaintext) in lib/vcall.js - custom-c2: api.jsonsilo.com (plaintext) in lib/vcall.js EXFIL - Fetch and Eval/Exec in lib/vcall.js: "axios.get(api)).data.model; const handler = new Function" - Network Request in lib/vcall.js: "axios.get(" OBFUSCATION - Decoded Base64 Content in lib/const.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Detached Child Process Payload in index.js: "spawn("node", [script, JSON.stringify(args)], { detached: true" - Dynamic Code Execution in lib/redaction.js: "exec(str)" - Brand New Package PAYLOAD FILES lib/vcall.js (+ lib/const.js) INDICATORS (IOCs) - urls: http://192.168.1.42:9200, https://jsonkeeper.com/b/ZK45J - domains: jsonkeeper.com - payloadFileHash: 277f1492a353d0bea073792f7110ebdf3b266dcca9c6fe09979711e10cbc8498