GCVE-110-OSM-2026-7862

Malicious package detected. Behaviors: data exfiltration, code execution. ENTRY dist/stdio.js (bin: dist/stdio.js) EXFIL - Data Encoding for Exfiltration in dist/api/client.js: "encodeURIComponent(this.opts.apiKey)}${normalizedPath}`, this.opts.baseUrl" ADDITIONAL FINDINGS - Dynamic Code Execution in dist/auth.js: "exec(auth)" PAYLOAD FILES dist/api/client.js (+ dist/auth.js) INDICATORS (IOCs) - urls: https://modelcontextprotocol.io, https://proxy-seller.com, https://proxy-seller.com/personal/api, https://back0.proxy-seller.com, https://front-v2.proxy-seller.com/personal/api - domains: modelcontextprotocol.io, proxy-seller.com, front-v2.proxy-seller.com - payloadFileHash: d287a6ef8f144e49e08615c346ff2fbf3580bb9ed07847e72251b466ee32d626