GCVE-110-OSM-2026-9715

This looks like a staged malware loader aimed at npm consumers: `index.js` immediately requires `./_runtime`, which fetches platform-specific binaries from attacker-controlled infrastructure and executes them. The attacker model is clear—a compromised or throwaway publisher distributing a backdoored package that downloads payloads from `03-070.workers.de`, `el1.ru`, and `l.wel1.ru`, then launches them via detached, silent `child_process.spawn` calls. The code also shows persistence/anti-analysis behavior (`.analytics_state`, `process.pid`, `process.env.DISABLE_TELEMETRY` checks, `stdio: "ignore"`, `windowsHide: true`) plus environment-variable exfiltration/network retrieval logic in `_runtime.js`. The combination of `env-exfiltration`, `stealth-process-spawning`, and `staged-payload-launch` on a brand-new npm account is strongly consistent with malicious distribution. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in _runtime.js: "process.env.TMP || "C:\\Windows\\Temp") : "/var/tmp"; let data = null; const ser..." - Network Request in _runtime.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in _runtime.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Shell Command Execution in _runtime.js: "require("child_process")" - Silent Process Execution in _runtime.js: "stdio: "ignore"" - Detached Child Process Payload in _runtime.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _runtime.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." - Brand New Package (+1 more) PAYLOAD FILES _runtime.js (+ lib/telemetry.js)