GCVE-110-OSM-2026-9130

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://api.ingress-hub.com/cdn/assets/update.pkg (primary, decoded) in index.js - custom-c2: api.ingress-hub.com (decoded) in index.js EXFIL - System Information Exfiltration in scripts/postinstall.js: "os.homedir(), 'AppData', 'Local', 'Microsoft', 'MSBuild', 'NativeTools'), a: 'Mo..." - Network Request in index.js: "https.get(" - System Information Collection in index.js: "os.platform()" - Network Request in scripts/postinstall.js: "https.get(" - System Information Collection in scripts/postinstall.js: "os.platform()" OBFUSCATION - Decoded Base64 Content in index.js - Decoded Base64 Content in scripts/postinstall.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn(_P, [], { detached: true, stdio: 'ignore', windowsHide: true, }" - Shell Command Execution in index.js: "require('child_process')" - Silent Process Execution in index.js: "stdio: 'ignore'" - Detached Child Process Payload in index.js: "spawn(_P, [], { detached: true" - Stream Response to Execution in scripts/postinstall.js: "pipe(file); file.on('finish', () => file.close(cb)); }); req.on('error', (e) => ..." PAYLOAD FILES scripts/postinstall.js (+ index.js) INDICATORS (IOCs) - payloadFileHash: d02f47d229261cc76602f351fc083334fd53649e39520dc18fec19b59a6538a1