GCVE-110-OSM-2026-9061

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, install-time execution. ENTRY install.js (install-hook: node install.js) - Install Hook Executes Local JS File in package.json DESTINATION - reconstructed: https://api.telegram.org/bot/sendMessage (primary, reconstructed) in install.js - custom-c2: api.telegram.org (reconstructed) in install.js - telegram-bot: api.telegram.org/bot${BOT_TOKEN}/sendMessage`; (plaintext) in install.js - custom-c2: get.scoop.sh (plaintext) in install.js - custom-c2: 172.94.9.157 (plaintext) in install.js EXFIL - Network Request in install.js: "https.request(" - System Information Collection in install.js: "os.hostname()" - Suspicious Domain in install.js: "http://172.94.9.157" - Suspicious Domain in setup.ps1: "http://172.94.9.157" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in install.js: "https://api.telegram.org/bot/sendMessage" - Shell Command Execution in install.js: "require('child_process')" - Silent Process Execution in install.js: "windowsHide: true" PAYLOAD FILES install.js INDICATORS (IOCs) - payloadFileHash: d06919a5eace0256f81324e6e08c71eb8284f4c7f4af91d24a50d2d11dd50342