GCVE-110-OSM-2026-7650

Malicious package detected. Behaviors: data exfiltration, code execution. ENTRY index.js (main: index.js) DESTINATION - custom-c2: http://ip-api.com/json (primary, plaintext) in index.js - custom-c2: https://randomuser.me/api/ (plaintext) in index.js - custom-c2: https://restcountries.com/v3.1/all (plaintext) in index.js - custom-c2: https://api.open-meteo.com/v1/forecast?latitude=35&longitude=139&current=temperature_2m (plaintext) in index.js - custom-c2: https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd (plaintext) in index.js - custom-c2: https://jsonplaceholder.typicode.com/posts (plaintext) in index.js - custom-c2: https://dummyjson.com/products (plaintext) in index.js - custom-c2: https://catfact.ninja/fact (plaintext) in index.js (+11 more) EXFIL - Payload Download from Paste Service in index.js: "jsonkeeper.com" ADDITIONAL FINDINGS - Dynamic Code Execution in index.js: "Function.constructor(" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: d728dba07907e6c714a2ec66922a66f176a2464bfc704c361c7f34b03ddd2633