GCVE-110-OSM-2026-9233

A package self-described as 'dependency-free calendar-day bucketing and streak math primitives' has zero legitimate reason to spawn a detached child process with fully suppressed I/O (`spawn(c, [], { stdio: 'ignore', detached: true }`). This pattern — executing a variable `c` (implying a dynamically resolved command or path) in a background process that survives parent exit — is the canonical dropper/loader technique used across npm malware campaigns. The presence of `process.platform` alongside this suggests platform-conditional payload selection. Publisher metadata reinforces adversarial intent: brand-new proton.me account with a single package, no source repository, and creation timestamp essentially identical to publish timestamp. Without file contents or recovered IOCs, the full attack chain (what `c` resolves to, whether it fetches a remote payload) cannot be confirmed, which is why this stops at suspicious rather than malicious — but the behavioral profile is strongly characteristic of a dropper. EXFIL - System Information Collection in index.mjs: "process.platform" ADDITIONAL FINDINGS - Silent Process Execution in index.mjs: "stdio: 'ignore'" - Detached Child Process Payload in index.mjs: "spawn(c, [], { stdio: 'ignore', detached: true" PAYLOAD FILES index.mjs INDICATORS (IOCs) - payloadFileHash: d3c35c429dde7ce7789db727c146052a41524f031700726e19da0ae1fbdfdba4