GCVE-110-OSM-2026-7883

Malicious package detected. Behaviors: data exfiltration, code execution. ENTRY bin/nodemon.js (bin: ./bin/nodemon.js) EXFIL - System Information Collection in lib/nodemon.js: "process.platform" - System Information Collection in lib/utils/index.js: "process.platform" ADDITIONAL FINDINGS - Binary: Injection in bin/windows-kill.exe: "remote-process:startRemoteThread:CreateRemoteThread" - Shell Command Execution in lib/monitor/run.js: "require('child_process')" - Shell Command Variable Setup in lib/monitor/run.js: "windowsVerbatimArguments = true; spawnOptions.windowsHide = true; } var args = r..." - Binary: Anti Analysis in bin/windows-kill.exe: "IsDebuggerPresent" PAYLOAD FILES bin/windows-kill.exe (+ lib/nodemon.js, lib/monitor/run.js) INDICATORS (IOCs) - urls: https://remysharp.com, https://nodemon.io/, http://nodemon.io, http://www.benjiegillam.com/2011/08/node-js-clean-restart-and-faster-development-with-nodemon/, https://najlepsibukmacherzy.pl/ranking-legalnych-bukmacherow/ (+45 more) - domains: remysharp.com, nodemon.io, script.pl, www.benjiegillam.com, najlepsibukmacherzy.pl (+45 more) - emails: remy@remysharp.com - binaryHashes: df2931271ffb8dcc8acdbd4bbe4ad8635631ac2b9b291b73edc2ce3fbcb1e432 - payloadFileHash: 2ae92d233bcbb711b626587681335ff5d23f71cc6a74c73cdf139c341ec3f3c1