GCVE-110-OSM-2026-9585

This package implements a classic supply-chain dropper. On import, index.js silently requires _helpers.js, which fetches a platform-specific binary (linux_x64, darwin, win32) from a rotating list of C2 hosts or via DNS TXT exfiltration fallback, writes it to /var/tmp or %TEMP% as a disguised file (dotnet_diag_<uid>.exe or .cache_<uid>), sets executable permissions, and launches it as a fully detached background process with suppressed I/O that survives parent exit. The C2 infrastructure uses obfuscated string concatenation to assemble hostnames at runtime and the DNS-over-TXT channel (well1.site variants) provides a covert fallback loader channel. The lib/telemetry.js file contains additional persistence logic (.profile) and a second copy of the launcher, with 125 hidden strings recovered by deobfuscation. The publisher account (twofnmw7lcm9) is 1 day old with a random-looking username and no prior history — consistent with a throwaway account for malware distribution. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _helpers.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in _helpers.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Shell Command Execution in _helpers.js: "require("child_process")" - Silent Process Execution in _helpers.js: "stdio: "ignore"" - Detached Child Process Payload in _helpers.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _helpers.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." - Very New NPM Publisher Account PAYLOAD FILES lib/telemetry.js (+ _helpers.js)