GCVE-110-OSM-2026-7695

Malicious package detected. Behaviors: data exfiltration, network activity, obfuscated code, install-time execution. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json - Preinstall Script in package.json LOOT - Cryptocurrency Wallet Theft in postinstall.js: "wallet.dat" DESTINATION - custom-c2: http://107.161.90.180:7777 (primary, plaintext) in postinstall.js - custom-c2: 107.161.90.180 (plaintext) in postinstall.js EXFIL - System Information Exfiltration in postinstall.js: "os.hostname(),u:os.userInfo().username,cwd:hint||process.cwd(),c:c.substring(0,1..." - HTTP Data Exfiltration in postinstall.js: "os.hostname(),u:os.userInfo().username,cwd:hint||process.cwd(),c:c.substring(0,1..." - Network Request in postinstall.js: "http.request(" - System Information Collection in postinstall.js: "os.userInfo()" - Suspicious Domain in postinstall.js: "http://107.161.90.180" OBFUSCATION - String Array Obfuscation in postinstall.js: "['abandon','ability','able','about','above','absent','absorb','abstract','absurd..." ADDITIONAL FINDINGS - Platform Detection with Data Collection in postinstall.js: "JSON.stringify({t:t,h:os.hostname(),u:os" - Very New NPM Publisher Account PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: 6c9c16897e74d441ac24472d86e97fac219c2fc56f14408ef406b2883df03654