GCVE-110-OSM-2026-7976

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY .init.js (install-hook: node .init.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://webhook.cool/at/tender-deer-80/hG-DWynJKenViD9XWI5Mf8CulD0I9G2s (primary, plaintext) in .init.js - custom-c2: webhook.cool (plaintext) in .init.js EXFIL - Network Request in .init.js: "https.request(" - System Information Collection in .init.js: "os.hostname()" PAYLOAD FILES .init.js INDICATORS (IOCs) - payloadFileHash: 6eb3939e40f85d1c3f591a3cd3a3edf0fd00c9b09fd7cb48f62e11edca3219b2