GCVE-110-OSM-2026-8318

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, install-time execution. ENTRY setup.js (install-hook: node setup.js) - Install Hook Executes Local JS File in package.json DESTINATION - reconstructed: https://api.telegram.org/bot/sendMessage (primary, reconstructed) in setup.js - custom-c2: api.telegram.org (reconstructed) in setup.js - telegram-bot: api.telegram.org/bot${BOT_TOKEN}/sendMessage`; (plaintext) in setup.js - custom-c2: get.scoop.sh (plaintext) in setup.js - custom-c2: 172.94.9.157 (plaintext) in setup.js EXFIL - Network Request in setup.js: "https.request(" - System Information Collection in setup.js: "os.hostname()" - Suspicious Domain in setup.js: "http://172.94.9.157" - Suspicious Domain in setup.ps1: "http://172.94.9.157" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in setup.js: "https://api.telegram.org/bot/sendMessage" - Shell Command Execution in setup.js: "require('child_process')" - Silent Process Execution in setup.js: "windowsHide: true" PAYLOAD FILES setup.js INDICATORS (IOCs) - urls: https://WordPress.github.io/block-development-examples/?tags=minimal, https://playground.wordpress.net/?blueprint-url=https://raw.githubusercontent.com/WordPress/block-development-examples/trunk/plugins/basic-esnext-a2ab62/_playground/blueprint.json, https://developer.wordpress.org/block-editor/getting-started/, https://developer.wordpress.org/block-editor/reference-guides/block-api/block-registration/, https://developer.wordpress.org/block-editor/reference-guides/packages/packages-scripts/ (+3 more) - domains: WordPress.github.io, playground.wordpress.net, developer.wordpress.org, schemas.wp.org, tailwindcss.com (+1 more) - payloadFileHash: 58a3cc4580ab8bb5cded5413deb93ed64d0ccd6ee2d531b29cc906c4cf130bf3