GCVE-110-OSM-2026-7899

Malicious package detected. Behaviors: data exfiltration, code execution. ENTRY index.js (bin: index.js) DESTINATION - custom-c2: https://night-watch-indol.vercel.app (primary, plaintext) in index.js - custom-c2: night-watch-indol.vercel.app (plaintext) in index.js EXFIL - Data Encoding for Exfiltration in index.js: "encodeURIComponent(apiKey" - System Information Collection in index.js: "os.homedir()" ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn('cmd', ['/c', 'start', '', url], { detached: true, stdio: 'ignore' }).unre..." - Shell Command Execution in index.js: "require('child_process')" - Silent Process Execution in index.js: "stdio: 'ignore'" - Detached Child Process Payload in index.js: "spawn('cmd', ['/c', 'start', '', url], { detached: true" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 6466712fcb4b91d97b95dfc063bc8dbaf6dc1808203d58bf808fca3adc6bbffd