GCVE-110-OSM-2026-7875

Malicious package detected. Behaviors: obfuscated code, install-time execution. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json OBFUSCATION - Obfuscation: augmented proxied array function replacements in scripts/postinstall.js - Hex Encoded Strings in scripts/postinstall.js: "'\x57\x4f\x42\x64\x4a\x43\x6b\x41\x57\x4f\x65'" - Unicode Escape Obfuscation in scripts/postinstall.js: "\x57\x4f\x42\x64\x4a\x43\x6b\x41\x57\x4f\x65" - Decoded Hex Escape Content in scripts/postinstall.js (x218) - Deobfuscation Failed in scripts/postinstall.js - Obfuscation patterns: hexHeavy in scripts/postinstall.js ADDITIONAL FINDINGS - Rapid Version Publishing PAYLOAD FILES scripts/postinstall.js INDICATORS (IOCs) - urls: https://docs.tqm-mfe.io/platform/main, https://jira.tqm-mfe.io/projects/PLATFORM, https://npm.tqm-mfe.io, https://github.tqm-mfe.io/platform/main.git - emails: platform@tqm-mfe.io - payloadFileHash: fff1afe3e53a24daa7457d4ce6e9a9a6a559cc1d72a91663d208e6006ac365a0