GCVE-110-OSM-2026-7889

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY bin/opencode-clawmessenger (bin: bin/opencode-clawmessenger) DESTINATION - custom-c2: api-b.rong-api.com (primary, plaintext) in dist/rongcloud/server-api.js EXFIL - Environment Variable Exfiltration in dist/standalone.js: "process.env.CLAW_REGISTER_PASSWORD||_0x84a836[_0x17c4a9(0xf2)]||_0xfd1650[_0x17c..." - Data Encoding for Exfiltration in dist/cli.js: "encodeURIComponent(_0x342795);console[_0x5e84af(0x1eb)](_0x1735c0[_0x5e84af(0x24..." - Data Encoding for Exfiltration in dist/rongcloud/server-api.js: "encodeURIComponent(_0x4ecfb0)+'='+encodeURIComponent(_0x46885f!==null&&typeof _0..." - System Information Collection in dist/core/installer.js: "process.platform" OBFUSCATION - Obfuscation: augmented proxied array function replacements in dist/cardkit/action-router.js - Obfuscation: augmented proxied array function replacements in dist/cardkit/agent-prompt.js - Obfuscation: augmented proxied array function replacements in dist/cardkit/builders.js - Obfuscation: augmented proxied array function replacements in dist/cardkit/index.js - Obfuscation: augmented proxied array function replacements in dist/cardkit/parse-marker.js - Obfuscation: augmented proxied array function replacements in dist/cardkit/schema.js - Obfuscation: augmented proxied array function replacements in dist/cardkit/templates.js - Obfuscation: augmented proxied array function replacements in dist/cardkit/update-controller.js (+90 more) ADDITIONAL FINDINGS - Download Execute Delete Pattern in dist/core/installer.js: "execFile, spawn } from 'node:child_process'; import { readFile, access, mkdir, w..." - Shell Command Execution in dist/cli.js: "require('child_process')" - Shell Command Variable Setup in dist/core/installer.js: "Windows） * * npm 在 Windows 会同时生成：opencode（无扩展名）、opencode.cmd、opencode.ps1。 * Pow..." - Publisher Has Other Malicious Packages PAYLOAD FILES dist/standalone.js (+ dist/cli.js, dist/core/installer.js) INDICATORS (IOCs) - ipv4: 1.1.17.7 - urls: http://host.docker.internal:19876, https://newsradar.dreamdt.cn/im`, http://127.0.0.1:19876`, https://newsradar.dreamdt.cn/im - domains: newsradar.dreamdt.cn - payloadFileHash: 5dafcf82817eba2a224351e1b2cebe1343a90d11cc5bfa5b3b5b9e297b873846