GCVE-110-OSM-2026-9547

Fake "internal" corporate MCP/audit tool acting as a second-stage malware dropper. A preinstall hook auto-executes index.js on install, launching a hidden-window PowerShell cradle that downloads a ZIP payload from catbox.moe, extracts it, and runs the contained EXE — full remote code execution with the installing user's privileges. The 99.9.9 version and corporate-sounding name are squatting/lure tactics. No legitimate functionality. index.js spawns PowerShell with a hidden window (-w hidden style), fetches a ZIP archive from a catbox.moe URL (https://files.catbox.moe/5khq55.zip), unpacks it to a temp/working directory, and Start-Processes the dropped EXE. Classic download-and-execute chain; the remote payload is operator-controlled and mutable