GCVE-110-OSM-2026-9592

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code, install-time execution. ENTRY dist/cli.js (bin: dist/cli.js) - Preinstall Script in package.json: ""preinstall": "node -e \"" PERSISTENCE - Startup Persistence in dist/commands/agent/agent-dispatch.js: ".profile" - Startup Persistence in dist/commands/agent/agent-support.js: ".profile" - Startup Persistence in dist/commands/agent/contribute-cli.js: ".profile" - Startup Persistence in dist/commands/config-cli.js: ".profile" - Startup Persistence in dist/commands/health/checks.js: ".profile" - Startup Persistence in dist/commands/health.js: ".profile" - Startup Persistence in dist/commands/improve/consolidate.js: ".profile" - Startup Persistence in dist/commands/improve/extract.js: ".profile" (+29 more) DESTINATION - reconstructed: https://api.github.com/repos/itlackey/akm/releases/latest (primary, reconstructed) in dist/commands/sources/self-update.js - reconstructed: http://localhost:11434/api/tags (reconstructed) in dist/commands/sources/self-update.js - custom-c2: api.github.com (reconstructed) in dist/commands/sources/self-update.js - custom-c2: https://...` (plaintext) in dist/registry/resolve.js - custom-c2: http://...` (plaintext) in dist/registry/resolve.js - custom-c2: https://dns.google (plaintext) in dist/setup/setup.js - custom-c2: https://ollama.com (plaintext) in dist/setup/setup.js - custom-c2: https://your-host/v1/chat/completions (plaintext) in dist/setup/setup.js (+12 more) EXFIL - Corporate Environment Targeting in dist/commands/improve/memory/memory-improve.js: "tMonth(d.getMonth() - n); } else { return match" - Corporate Environment Targeting in dist/commands/remember.js: "tMonth(d.getMonth() - 1), }; function detectObservedAt(body) { const isoMatch = ..." - Corporate Environment Targeting in dist/llm/embedders/local.js: "tModel) { this.defaultModel = defaultModel; } /** Reset the cached pipeline (use..." - Corporate Environment Targeting in dist/output/context.js: "tMode() before getOutputMode()."); } return _mode; } /** * Reset the singleton. ..." - Corporate Environment Targeting in dist/setup/detect.js: "tModel(models) { const cleaned = models.filter" - Corporate Environment Targeting in dist/setup/setup.js: "tModels = ollama.models.filter((m) => !embeddingModels.includes" - Git Configuration Access in dist/indexer/walk/project-context.js: ".git/config" - Data Encoding for Exfiltration in dist/registry/build-index.js: "encodeURIComponent(keyword)}&size=${size}&from=${offset" (+29 more) OBFUSCATION - Obfuscation: function to array replacements in dist/commands/improve/improve.js - Dynamic Base64 Decoding in dist/scripts/migrate-storage.js: "atob(base64)" - Dynamic Base64 Decoding in dist/scripts/migrations/import-fs-improve-runs-to-db.js: "atob(src." - Unicode Escape Obfuscation in dist/scripts/migrate-storage.js: "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u..." - Unicode Escape Obfuscation in dist/scripts/migrations/import-fs-improve-runs-to-db.js: "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u..." - Deobfuscation Failed in dist/commands/improve/improve.js - Obfuscation patterns: unicodeHeavy in dist/scripts/migrate-storage.js - Obfuscation patterns: unicodeHeavy in dist/scripts/migrations/import-fs-improve-runs-to-db.js (+1 more) ADDITIONAL FINDINGS - Download Execute Delete Pattern in dist/commands/sources/self-update.js: "writeFileSync(execPath, binaryData); } catch (err) { // Restore from old fs.rena..." - Reconstructed Obfuscated URL in dist/commands/sources/self-update.js: "https://api.github.com/repos/itlackey/akm/releases/latest" - Shell Command Execution in dist/commands/env/env-cli.js: "spawnSync(" - Platform Detection with Data Collection in dist/commands/improve/improve.js: "JSON.stringify({ pid: process.pid, startedAt: new Date().toISOS" - Dynamic Code Execution in dist/commands/lint/base-linter.js: "exec(body)" PAYLOAD FILES dist/scripts/migrate-storage.js (+ dist/scripts/migrations/import-fs-improve-runs-to-db.js, dist/setup/detect.js) INDICATORS (IOCs) - urls: https://claude.ai/code, https://opencode.ai, https://cursor.com, https://skills.sh, http://localhost:11434` (+5 more) - domains: skills.sh, cursor.com, env.sh, m.global, s.group (+16 more) - emails: fix@consolidate.ts, key_1234@dotenvx.com - payloadFileHash: 5a125417cc1894faa28f12d4a41d567213dd8cb7ebbab2f87f2a869e9dbae306