GCVE-110-OSM-2026-8710

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY lib/index.js (main: lib/index.js) PERSISTENCE - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" DESTINATION - custom-c2: https://rest-api.vreden.my.id/biz?id= (primary, decoded) in lib/Socket/socket.js - custom-c2: https://rest-api.vreden.my.id/buttons?id= (decoded) in lib/Socket/socket.js - custom-c2: update.me (plaintext) in lib/Socket/socket.js - custom-c2: mmg.whatsapp.net (plaintext) in lib/Utils/messages-media.js EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString('base64')" OBFUSCATION - Decoded Base64 Content in lib/Socket/socket.js (x2) - Dynamic Base64 Decoding in WASignalGroup/group_cipher.js: "Buffer.from(iv, 'base64')" - Dynamic Base64 Decoding in WASignalGroup/sender_chain_key.js: "Buffer.from(key, 'base64')" - Dynamic Base64 Decoding in WASignalGroup/sender_key_state.js: "Buffer.from(chainKey, 'base64')" - Dynamic Base64 Decoding in lib/Socket/socket.js: "atob(defaultMaxListenersBuffer)" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, 'base64')" - Dynamic Base64 Decoding in lib/Utils/generics.js: "Buffer.from(val, 'base64')" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, 'base64')" (+8 more) ADDITIONAL FINDINGS - Dynamic Code Execution in lib/Socket/messages-recv.js: "exec(node)" - Platform Detection with Data Collection in lib/Socket/messages-recv.js: "JSON.stringify({ ...child, content: Buffer.isBuffer(child.content) ? child.conte..." - Shell Command Execution in lib/Socket/socket.js: "require("child_process")" PAYLOAD FILES lib/Socket/socket.js INDICATORS (IOCs) - ipv4: 2.24.6.77 - urls: https://web.whatsapp.com/check-update?version=1&platform=web - domains: SenderKeyMessage.prototype.id, SenderKeyDistributionMessage.prototype.id, sock.ws, creds.me, whatsapp.net (+24 more) - emails: 16505361212@c.us, server@c.us, 0@c.us - payloadFileHash: 707d16fa92b36ff6c3097a345c8515ac9d57642ba5edd332ab7fe49c011f3379