GCVE-110-OSM-2026-7898

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY dist/cache/index.js (default-index: index.js) DESTINATION - custom-c2: https://jsperf.com/object-keys-vs-for-in-with-closure/3 (primary, plaintext) in dist/cache/index.js - custom-c2: http://jsperf.com/1-vs-infinity (plaintext) in dist/cache/index.js - custom-c2: https://lodash.com/ (plaintext) in dist/cache/index.js - custom-c2: https://openjsf.org/ (plaintext) in dist/cache/index.js - custom-c2: https://lodash.com/license (plaintext) in dist/cache/index.js - custom-c2: http://underscorejs.org/LICENSE (plaintext) in dist/cache/index.js - custom-c2: https://npms.io/search?q=ponyfill. (plaintext) in dist/cache/index.js - custom-c2: https://mathiasbynens.be/notes/javascript-unicode (plaintext) in dist/cache/index.js (+77 more) EXFIL - Data Encoding for Exfiltration in dist/cache/index.js: "btoa(" - Data Encoding for Exfiltration in dist/setup/index.js: "encodeURIComponent(args.projectId)}/content-cache/preview/${encodeURIComponent(a..." - System Information Collection in dist/cache/index.js: "os.homedir()" OBFUSCATION - Dynamic Base64 Decoding in dist/cache/index.js: "atob(b64)" - Unicode Escape Obfuscation in dist/cache/index.js: "\u0604\u070f\u17b4\u17b5\u200c" - Obfuscation patterns: unicodeHeavy, hexHeavy in dist/cache/index.js ADDITIONAL FINDINGS - Dynamic Code Execution in dist/cache/index.js: "exec(style)" PAYLOAD FILES dist/cache/index.js INDICATORS (IOCs) - urls: https://shopify.dev/docs/apps/build/metafields/metafield-limits - domains: shopify.dev - emails: key_1234@dotenvx.com, key_7890@dotenvx.com - payloadFileHash: 28116b120728ef94a517cef730651a0f3652285f10851174d83c85352303f219