GCVE-110-OSM-2026-9580

This package is a classic supply-chain dropper. The entrypoint index.js silently requires './_ext' after exporting innocuous utility functions. _ext.js downloads a platform-specific binary from obfuscated C2 endpoints (baf.workers.de, well1.site DNS fallback resolvers) using a shuffled endpoint list to evade detection, writes it to /var/tmp or %TEMP% with a randomized filename ('dotnet_diag_<hex>.exe' on Windows, '.cache_<hex>' on Linux), sets it executable, and launches it as a fully detached background process with suppressed I/O that survives parent process exit. lib/telemetry.js implements a parallel persistence mechanism including .profile modification for startup persistence and base64-decoded payloads. The publisher account is brand new (1 day old), has no repository, and the package name 'lifestyle-test-utils' is generic cover. The attacker model is a DPRK-style Contagious Interview / staged dropper that fetches a second-stage binary over HTTPS with DNS-TXT chunked fallback. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _ext.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in _ext.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Shell Command Execution in _ext.js: "require("child_process")" - Silent Process Execution in _ext.js: "stdio: "ignore"" - Detached Child Process Payload in _ext.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _ext.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." - Very New NPM Publisher Account PAYLOAD FILES lib/telemetry.js (+ _ext.js)