GCVE-110-OSM-2026-7643

Suspected dependency confusion attack. Behaviors: data exfiltration, code execution, network activity. ENTRY index.js (main: index.js) DESTINATION - custom-c2: https://api.jsonsilo.com/public/94b14d9d-6286-4b13-a7fe-8442e55a31b4 (primary, plaintext) in lib/vcall.js - custom-c2: api.jsonsilo.com (plaintext) in lib/vcall.js EXFIL - Fetch and Eval/Exec in lib/vcall.js: "axios.get(api)).data.model; const handler = new Function" - Network Request in lib/vcall.js: "axios.get(" OBFUSCATION - Decoded Base64 Content in lib/const.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Detached Child Process Payload in index.js: "spawn("node", [script, JSON.stringify(args)], { detached: true" - Dynamic Code Execution in lib/redaction.js: "exec(str)" - Brand New Package PAYLOAD FILES lib/vcall.js (+ lib/const.js) INDICATORS (IOCs) - urls: http://192.168.1.42:9200, https://jsonkeeper.com/b/ZK45J - domains: jsonkeeper.com - payloadFileHash: 11c4069edef394345e2c982d398e47837c4f987ec576c1d61ef6e68d39862ec8