GCVE-110-OSM-2026-9581

This malicious package is a cross-platform downloader/loader that retrieves a native executable, writes it to a temporary directory, marks it executable, and launches it in the background. ADDITIONAL FINDINGS - Brand New Package The HTTPS response body is accepted as a raw binary when the serv er returns HTTP 200. The only validation is that it exceeds 1,000 bytes—there is no signature, hash, content-type, or integrity check. Downloaded filenames: - Windows: %TEMP%\dotnet_diag_<8-random-hex>.exe - Linux/macOS: /var/tmp/.cache_<8-random-hex> Execution: - Windows: cmd.exe /c start /b <payload> - Linux/macOS: /bin/sh -c "<payload> &" On Unix-like systems it first applies mode 0755. Execution is detached and output is suppressed.