GCVE-110-OSM-2026-9043

This package is a classic install-time malware dropper. The postinstall hook executes `node index.js` immediately on npm install, and index.js is heavily obfuscated using proxied array-function replacement techniques. Deobfuscation successfully recovered two IOCs hidden inside the obfuscated layer: an IPv4 address (144.172.117.57) and a C2-style API endpoint (http://144.172.117.57/api/service/77a74c827c6d81b73957a230f9439487), which is consistent with a beacon or payload-fetch callback pattern. The publisher 'genmaxim' has zero other packages, no repository, and the package is already flagged as malicious in the OSM database. The attacker model is a supply-chain compromise via typosquatting or direct publish, triggering C2 contact on install. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json OBFUSCATION - IOCs Found in Deobfuscated Code in index.js - Obfuscation: augmented proxied array function replacements in index.js - Obfuscation (osm-deobfuscator): unknown in index.js - recovered 1 ipv4, 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Malicious Dependency Detected (OSM) in package.json - Malicious Dependency Detected in package.json PAYLOAD FILES index.js INDICATORS (IOCs) - ipv4: 144.172.117.57 - urls: http://144.172.117.57/api/service/77a74c827c6d81b73957a230f9439487 - payloadFileHash: a00860eab180952dff69a77cc70774d8eb5c5104bc0774ee668866ee9dc4a50f