GCVE-110-OSM-2026-7674

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY index.js (main: index.js) EXFIL - Dynamic C2 Endpoint Construction in lib/collect.js: "'env.')) return true; if (/^\.?env\([^)]+\)/.test(lower)) return true; if (lower..." - System Information Collection in lib/collect.js: "os.platform()" - System Information Collection in lib/upload.js: "os.userInfo()" OBFUSCATION - Dynamic Base64 Decoding in index.js: "Buffer.from(encoded, 'base64')" - Decoded Base64 Content in index.js - Strings Extracted from Deobfuscated Code in index.js ADDITIONAL FINDINGS - Dynamic Code Execution in lib/collect.js: "exec(content)" - Shell Command Execution in lib/collect.js: "require('child_process')" - Platform Detection with Data Collection in lib/upload.js: "JSON.stringify({ created, username, publicIp: 'unknown', platform: process.platf..." - Very New NPM Publisher Account PAYLOAD FILES lib/collect.js (+ lib/upload.js) INDICATORS (IOCs) - payloadFileHash: 3bba21021a32cdcfa653be8f1f09a827af8c442780813af584cd555ee2765de0