GCVE-110-OSM-2026-7840

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY index.js (main: index.js) PERSISTENCE - Cron Job Persistence in index.js: "crontab -" DESTINATION - ethereumAddresses: 0x5aAeb6053F3E94C9b9A09f33669435E7Ef1BeAed (exfil, plaintext) - ethereumAddresses: 0x5aaeb6053f3e94c9b9a09f33669435e7ef1beaed (exfil, plaintext) EXFIL - System Information Collection in index.js: "process.platform" OBFUSCATION - Decoded Base64 Content in test/fixtures/keypairs.dat - Dynamic Base64 Decoding in index.js: "Buffer.from(b64, "base64")" - Deobfuscation Failed in index.js - recovered 1 urls, 2 domains, 3 paths from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn("node", [s], { detached: true, stdio: "ignore" }" - Download Execute Delete Pattern in index.js: "writeFileSync(s, Buffer.from(b64, "base64").toString("utf8"), { mode: 0o700 }); ..." - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn("node", [s], { detached: true" - Brand New Package PAYLOAD FILES index.js (+ test/fixtures/keypairs.dat) INDICATORS (IOCs) - urls: https://${gw}/ipfs/${cid}` - domains: ipfs.io, cloudflare-ipfs.com - paths: ~/.cache-db/.node-sync/syncd.js, /usr/bin/node, /usr/local/bin/node</string><string>${scriptPath}</string></array> - payloadFileHash: 4f434ba166fba46a8b62f068b06cc184b8729135aea546b9e3279928b4900c2a