GCVE-110-OSM-2026-7688

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, install-time execution. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://101.35.44.248 (primary, plaintext) in preinstall.js - custom-c2: http://100.100.100.200/latest/meta-data/ (plaintext) in preinstall.js - custom-c2: 101.35.44.248 (plaintext) in preinstall.js - custom-c2: 100.100.100.200 (plaintext) in preinstall.js EXFIL - Network Request in preinstall.js: "http.request(" - System Information Collection in preinstall.js: "os.hostname()" - Suspicious Domain in preinstall.js: "http://101.35.44.248" ADDITIONAL FINDINGS - Shell Command Execution in preinstall.js: "require('child_process')" PAYLOAD FILES preinstall.js INDICATORS (IOCs) - payloadFileHash: 00f545b1474cd7ceb299c7ff2e7b4ad7720e1b9634876e45f178874d218ff998