GCVE-110-OSM-2026-7860

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. DESTINATION - custom-c2: caliber-spinner-finishing.ngrok-free.dev (primary, deobfuscated) in index.js EXFIL - Environment Variable Exfiltration in index.js: "process.env[k].substring(0,100)}),{}),[__tm]:Date.now(),[__pk]:'neteller',[__ex]..." OBFUSCATION - IOCs Found in Deobfuscated Code in index.js - Dynamic Base64 Decoding in index.js: "Buffer.from(s,'base64')" - recovered 1 domains, 1 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Platform Detection with Data Collection in index.js: "JSON.stringify({[__hf]:require(__x('yJk=')).hos" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 50cb7550224d8d227a0625e7f53be86924d8e057e403b6b91b83ea20df834048