GCVE-110-OSM-2026-7865

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY cf/src/index.js (default-index: index.js) EXFIL - Environment Variable Exfiltration in types/index.d.ts: "process.env['PGTARGETSESSIONATTRS'] */ target_session_attrs: undefined | 'read-w..." - System Information Collection in cf/src/index.js: "os.userInfo()" - System Information Collection in cjs/src/index.js: "os.userInfo()" - System Information Collection in src/index.js: "os.userInfo()" OBFUSCATION - Global Variable Shadowing in cf/polyfills.js: "const process = {" - Strings Extracted from Deobfuscated Code in cf/polyfills.js ADDITIONAL FINDINGS - Shell Command Execution in cjs/src/errors.js: "require('child_process')" PAYLOAD FILES types/index.d.ts INDICATORS (IOCs) - ipv4: 1.10.6.7 - urls: https://gitter.im/porsager/postgres, https://www.postgresql.org/docs/current/protocol-flow.html#id-1.10.6.7.4, https://www.postgresql.org/docs/14/sql-copy.html, https://www.postgresql.org/docs/current/queries-with.html, https://www.postgresql.org/docs/current/sql-prepare-transaction.html (+5 more) - domains: gitter.im, www.postgresql.org, help.heroku.com, www.pgbouncer.org, porsager.com (+1 more) - emails: look@postgres.toCamel, rasmus@porsager.com - payloadFileHash: 3e9763c4afdadcdca1a4f469ffed3dcbbf5eddfc2aa04b5e588b514e4f57f9f1