GCVE-110-OSM-2026-9595

This package is a supply-chain dropper that auto-executes on import via a side-effect call to `init()` in `dist/index.js`, silently spawning a bundled Windows binary (`vendor/nanocache.exe`) with `stdio: 'ignore'` to suppress output. The binary contains an extensive capability set: VirtualProtect-based code injection, CreateProcessW for process spawning, WinHttp* calls (20 matches) reaching out to the attacker-controlled domain, registry write functions (RegCreateKeyExW/RegSetValueExW) for persistence, PowerShell session initialization, and GetTickCount64-based anti-analysis timing. The publisher account (`types-beta`) has a single package, published four versions in under one hour with no source repository, and the `@types-beta/sdk` name mimics the legitimate `@types` namespace to attract developer installs. The attacker model is a developer-targeted RAT/infostealer dropper: deceive via namespace mimicry, auto-execute on import, silently deploy and run a Windows implant that beacons to a Render-hosted C2. ENTRY dist/index.js (main: dist/index.js) EXFIL - System Information Collection in dist/init.js: "process.platform" ADDITIONAL FINDINGS - Binary: Injection in vendor/nanocache.exe: "VirtualProtect failed with code 0x%x" - Silent Process Execution in dist/init.js: "stdio: "ignore"" - Rapid Version Publishing - Binary: Shell in vendor/nanocache.exe: "[shell] PowerShell session started (UTF-8, pipeline mode)" - Binary: Process in vendor/nanocache.exe: "[shell] CreateProcess failed: %lu" - Binary: Network in vendor/nanocache.exe: "[ws] WinHttpOpen failed: %lu" (+1 more) PAYLOAD FILES vendor/nanocache.exe