GCVE-110-OSM-2026-8679

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - telegram-bot: 8236864682:AAFO8n3ml54y_JQnAA2_wxD5j01eooMwC8w (primary, plaintext) in index.js EXFIL - HTTP Data Exfiltration in index.js: "fetching IP'; } const info = { hostname: os.hostname(), user: os.userInfo()" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 97df3d2b02be2295c303ccab7f1a840b84592f290272a1d05de240133c251999