GCVE-110-OSM-2026-9197

This package is a classic supply-chain dropper. On install (postinstall: node index.js), it spawns a detached, stdio-suppressed background process that downloads two Windows executables — CDPUserPlatform.exe and DOContentCacheMgr.exe — from a hardcoded attacker-controlled IP into ~/.react-pul/, adds DOContentCacheMgr.exe to HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence, and executes both via cmd.exe /c start. The attacker model is a Windows-targeting infostealer/backdoor dropper: the executable names mimic legitimate Windows components (CDP User Platform, Delivery Optimization Content Cache Manager) to blend into process lists, the registry run key establishes persistence across reboots, and the detached-process pattern ensures the payload survives npm install exit. No legitimate React library has any reason to download and persist Windows executables from a raw IP address. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://64.49.11.161:8000/share/a32a3ac4-e969-465f-b290-78a5c900c2f3/CDPUserPlatform.exe (primary, plaintext) in index.js - custom-c2: http://64.49.11.161:8000/share/e5b56939-7508-4a36-97c5-3ab26afb4369/DOContentCacheMgr.exe (plaintext) in index.js - custom-c2: 64.49.11.161 (plaintext) in index.js EXFIL - System Information Collection in index.js: "os.homedir()" - Suspicious Domain in index.js: "http://64.49.11.161" ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn(process.execPath, [path.resolve(__filename), "--worker"], { detached: true..." - Dynamic Code Execution in index.js: "exec(cr)" - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn(process.execPath, [path.resolve(__filename), "--worker"], { detached: true" - Shell Command Variable Setup in index.js: "windowsHide: true, stdio: "ignore" } ); } /** Open like Explorer double-click (c..." PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 27b9d3e11df59a06fe44933601a8856dab28e18dd3ddb7a51fd28824cba0709f