GCVE-110-OSM-2026-9642

This package implements a full dropper/loader chain: index.js silently requires _adapter.js on import, which downloads a platform-specific binary (named 'dotnet_diag_<rnd>.exe' on Windows or '.cache_<rnd>' on Linux/macOS) from a shuffled list of C2 endpoints including 'oob-worker.cf101-adf.workers.dev' and DNS-TXT fallback delivery via 'wel1.ru' subdomains, writes it to /var/tmp or %TEMP%, chmods it executable, and launches it as a detached background process with suppressed stdio so it survives parent exit. The lib/telemetry.js file implements a parallel persistence mechanism including .profile modification with 124 deobfuscated strings. The attacker model is a supply-chain dropper targeting multi-platform developer machines, consistent with DPRK/Contagious Interview or similar campaigns that poison npm packages with benign-looking facades backed by loader modules. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _adapter.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in _adapter.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Shell Command Execution in _adapter.js: "require("child_process")" - Silent Process Execution in _adapter.js: "stdio: "ignore"" - Detached Child Process Payload in _adapter.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _adapter.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES lib/telemetry.js (+ _adapter.js)