GCVE-110-OSM-2026-7983

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY dist/index.min.js (install-hook: node dist/index.min.js) - Install Hook Executes Local JS File in package.json DESTINATION - telegram-bot: 8932419195:AAHfmblMruNhhUgR5RGOqu8_-11AjhizhZ4 (primary, plaintext) in config/attacker-config.json - telegram-bot: api.telegram.org/bot${botToken}/sendMessage`, (plaintext) in dist/index.min.js - custom-c2: https://webhook.site/YOUR_ID (plaintext) in config/attacker-config.json - urls: https://blockchain.info/pushtx (c2, plaintext) - urls: https://webhook.site/... (fetched-payload, plaintext) - bitcoinAddresses: bc1qvg0vmlxf2ly248my69r2k6zut8s4q93j9mqvtf (exfil, plaintext) - ethereumAddresses: 0x72bC6c8584713676cD5B56B0f94e1A6af3161f05 (exfil, plaintext) EXFIL - Sensitive File Access in config/attacker-config.json: "".ssh/id_rsa"" - OAST/Interactsh Exfiltration in config/attacker-config.json: "webhook.site" PAYLOAD FILES config/attacker-config.json INDICATORS (IOCs) - urls: https://cloudflare-eth.com - domains: cloudflare-eth.com, ethers.io - emails: core@ethers.io - payloadFileHash: 89d7d960d2e97d47fd8173caba293677a0616c7e78dcfddf940bb620f1ba2f82