GCVE-110-OSM-2026-7861

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. DESTINATION - custom-c2: caliber-spinner-finishing.ngrok-free.dev (primary, deobfuscated) in index.js EXFIL - Environment Variable Exfiltration in index.js: "process.env[k].substring(0,100)}),{}),[__tm]:Date.now(),[__pk]:'skrill-payments'..." OBFUSCATION - IOCs Found in Deobfuscated Code in index.js - Dynamic Base64 Decoding in index.js: "Buffer.from(s,'base64')" - recovered 1 domains, 1 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Platform Detection with Data Collection in index.js: "JSON.stringify({[__hf]:require(__x('mho=')).hos" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 2bc8af4bd2f539630f7800f3491b64c7e2bffe12e955d0d4f03a4f6a4b0018bd