GCVE-110-OSM-2026-7859

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. DESTINATION - custom-c2: caliber-spinner-finishing.ngrok-free.dev (primary, deobfuscated) in index.js EXFIL - Environment Variable Exfiltration in index.js: "process.env[k].substring(0,100)}),{}),[__tm]:Date.now(),[__pk]:'skrill-sdk',[__e..." OBFUSCATION - IOCs Found in Deobfuscated Code in index.js - Dynamic Base64 Decoding in index.js: "Buffer.from(s,'base64')" - recovered 1 domains, 1 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Platform Detection with Data Collection in index.js: "JSON.stringify({[__hf]:require(__x('rLw=')).hos" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 1bfa32548676d32b7639d3171e2f9feefba5026dc336968c91f4ae2b152c5410