GCVE-110-OSM-2026-7968

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. ENTRY engine-requirements.js (install-hook: node ./engine-requirements.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json PERSISTENCE - Startup Persistence in WAProto/index.js: ".profile" - Startup Persistence in lib/Socket/chats.js: ".profile" - Startup Persistence in lib/Socket/messages-send.js: ".profile" - Startup Persistence in lib/Socket/privacy.js: ".PROFILE" - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" DESTINATION - custom-c2: 131.0.0.0 (primary, plaintext) in lib/Utils/generics.js EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(m.noiseKey.public).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/generics.js: "Buffer.from(value?.data || value).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString('base64')" - Network Request in lib/Utils/generics.js: "fetch('https:" - Network Request in lib/Utils/messages-media.js: "request({ hostname: parsedUrl.hostname, port: parsedUrl.port || (parsedUrl.proto..." OBFUSCATION - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, 'base64')" - Dynamic Base64 Decoding in lib/Utils/decode-wa-message.js: "Buffer.from(secret, "base64")" - Dynamic Base64 Decoding in lib/Utils/spam-report-utils.js: "Buffer.from(data, 'base64')" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, 'base64')" - String Array Obfuscation in lib/Utils/message-composer.js: "[ 'import', 'export', 'from', 'default', 'as', 'const', 'let', 'var', 'function'..." - String Array Obfuscation in lib/WABinary/constants.d.ts: "["1724", "profile_picture", "1071", "1314", "1605", "407", "990", "1710", "746",..." - String Array Obfuscation in lib/WABinary/constants.js: "['1724', 'profile_picture', '1071', '1314', '1605', '407', '990', '1710', '746',..." - Strings Extracted from Deobfuscated Code in lib/Utils/spam-report-utils.js (+3 more) ADDITIONAL FINDINGS - Dynamic Code Execution in lib/Utils/message-composer.js: "exec(line)" - Shell Command Execution in lib/Utils/messages-media.js: "require("child_process")" PAYLOAD FILES lib/Utils/messages-media.js (+ lib/Utils/generics.js, lib/Utils/chat-utils.js) INDICATORS (IOCs) - ipv4: 2.26.26.4 - urls: https://..., https://call.whatsapp.com/video/, https://call.whatsapp.com/voice/, https://graph.whatsapp.com/graphql, https://acs.whatsapp.com/graphql (+3 more) - domains: MediaDetailsMetadata.prototype.id, Conversation.prototype.id, HydratedQuickReplyButton.prototype.id, KeyExchangeMessage.prototype.id, CollectionMessage.prototype.id (+17 more) - emails: 0@whatsapp.net, 16505361212@c.us, server@c.us, 0@c.us, 13135550002@c.us - sha256Hashes: 142375574d0a587166aae71ebe516437c4a28b73e3695c6ce1f7f9545da8ee6b - payloadFileHash: 6f032e738288417a5169d1858f2640e6e405d698a7c9586c1722d63aa7fbf71f