GCVE-110-OSM-2026-7868

Suspected dependency confusion attack. Behaviors: data exfiltration, code execution, install-time execution. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json EXFIL - Data Encoding for Exfiltration in index.js: "Buffer.from(psCommand, "utf16le").toString("base64")" - System Information Collection in index.js: "os.platform()" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Shell Command Variable Setup in index.js: "win32") { const psCommand = `Start-Process calc.exe -WindowStyle Hidden`; const ..." PAYLOAD FILES index.js INDICATORS (IOCs) - domains: vapan.org - emails: contact@vapan.org - payloadFileHash: ba863a083c54fd75f7341c1020db15b6d26622c72922716b3e1feadfd0c1496f